Towards Reducing the Data Exfiltration Surface for the Insider Threat

Conference · Fri Jan 01 00:00:00 EST 2016

DOI:https://doi.org/10.1109/HICSS.2016.345· OSTI ID:1328274

Schlicher, Bob G ^[1]; MacIntyre, Lawrence Paul ^[1]; Abercrombie, Robert K ^[1]

---

1. ORNL

Unauthorized data exfiltrations from both insiders and outsiders are costly and damaging. Network communication resources can be used for transporting data illicitly out of the enterprise or cloud. Combined with built-in malware copying utilities, we define this as comprising the Data Exfiltration Surface (DXS). For securing valuable data, it is desirable to reduce the DXS and maintain controls on the egress points. Our approach is to host the data in a protected enclave that includes novel software Data Diode (SDD) installed on a secured, border gateway. The SDD allows copying data into the enclave systems but denies data from being copied out. Simultaneously, it permits remote access with remote desktop and console applications. Our tests demonstrate that we are able to effectively reduce the DXS and we are able to protect data from being exfiltrated through the use of the SDD.

• Research Organization: Oak Ridge National Lab. (ORNL), Oak Ridge, TN (United States)
• Sponsoring Organization: Work for Others (WFO)
• DOE Contract Number: AC05-00OR22725
• OSTI ID: 1328274
• Resource Relation: Conference: 49th Annual Hawaii International Conference on System Sciences (HICSS-49), Kauai, HI, USA, 20160105, 20160108
• Country of Publication: United States
• Language: English