1

We have a few workstations that have access to a network share with all our company files. This is correct, because users may need to use them.
However our boss is concerned that someone (upon resignation maybe) may plug in a USB drive and take those files home or things like that. Since we can't forbid USB drives (we may need them for regular work) is there something we could do to improve security, making data theft more difficult?
I am the administrator of those workstations and the users don't have root powers (obviously).
Maybe SELinux/AppArmor can forbid copying from one particular directory to another?

  • 1
    You are aware that this situation really isn't "theft"? Since you and your boss aren't deprived of the use of the copied file, nothing has been "stolen". So, this reduces to the unwanted copying problem that the RIAA and MPAA have been trying to solve for years, unsuccessfully. – Bruce Ediger Mar 18 '15 at 13:01
  • @Bruce you don't have theft of intellectual property in your jurisdiction? – roaima Mar 18 '15 at 13:03
  • 1
    @BruceEdiger I tried to use a "googlable" phrase, but maybe "data leak" would fit too :) – Joril Mar 18 '15 at 13:23
  • @roaima - No, I do not. There's copyright infringement, patent infringement and something related to trade secrets. None of these are theft, in a legal or ethical sense. And the phrase "Intellectual Property" is itself misleading, as none of copyright, patent, trade secret, trade mark or trade dress are "property" in any sense of the word "property" except the most sloppy and childish usage. – Bruce Ediger Mar 18 '15 at 14:57
  • @BruceEdiger “Intellectual property” is also property in the usage of lawyers, which is certainly not sloppy (I will not comment as to the childishness). Exclusivity is a form of possession. – Gilles Mar 18 '15 at 22:44
3

No, you can't. If they can read the files they can copy them.

EDIT:

I've been thinking about it and maybe you can do something. If those files should only be accessed by a couple of programs (You said something about CAD files) maybe you can set the program owner to a new user (let's say CADuser) and change the permissions of all those files so that only CADuser can read them. Setting the sticky bit in the CAD program will allow those that run the program to be that user while the program is run thus being able to access and work with the files. But if they stop running the program they wont have access to those files. I have not tested, but I am pretty sure that if the file is saved to any other location the permissions will be those of the user of the program, so they won't be accessible outside the program, thus complicating the act of copying them to a USB.

  • Of course, but - for example - it would be quite cumbersome to send all our CAD files via email – Joril Mar 18 '15 at 14:18
  • 1
    I'm not saying that you have to send files one way or another, I'm just stating the fact that if you allow access to files, and allow access to USBs, you can't avoid anyone accessing those files to copy them in a USB and taking those files with them. – YoMismo Mar 18 '15 at 14:21
  • Uploading files via Gmail is quite easy. Same goes for other upload sites like Mega. – SPRBRN Mar 18 '15 at 16:38
  • Quite easy but still more troublesome than simply copying them onto a USB stick :) – Joril Mar 18 '15 at 16:41
  • 1
    @joril, your files will be as "protected" as your CAD software is free of bugs :D – YoMismo Mar 20 '15 at 7:25
5

It's very difficult, and more of a policy decision than a technical one IMO. There's just too many workarounds to 'get data from one place to another'. You could disallow copy, but how would you prevent cat $file > /usb/$file?

Simply not possible to do exhaustively.

I would suggest therefore you instead disallow workstation access to files, and require remote login to a server - to which the user has no direct physical access, and limit what they can do via sudo - e.g. not sudo su but instead a set of commands that are deemed 'safe enough'.

Either that, and/or be stricter about removable storage devices - make it a disciplinary offence to bring one in the building (that doesn't have appropriate audit trail and entry/exit checking).

But at a pretty fundamental level, this is a personnel security issue, not a technical one. A good starting point there is sack people you don't trust!

  • Well we could settle for a "not exhaustive" solution too, I guess :) Right now we are wide open to this kind of problem, and our boss would like at least to mitigate it – Joril Mar 18 '15 at 11:02
  • what would keep me from doing rsync over an encrypted tunnel to one of my AWS instances or VPS servers? – Skaperen Mar 18 '15 at 12:06
  • A firewall or egress protocol filtering. What we're talking about here, is really DRM. And that's a difficult thing unless you've full control over every endpoint. – Sobrique Mar 18 '15 at 12:08
  • almost all security issues are personnel isssues – Skaperen Mar 18 '15 at 12:08
  • I'm not sure I'd agree. I mean, you can apply access control and auditing and limit access to duly authorised users. That's an important security issue. But the technical domain only goes so far, and the 'issue' that is an authorised person misusing their access is no longer a technical matter. Which is why security clearance processes exist. – Sobrique Mar 18 '15 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.