Hacker News Reader

Comment by rurounijones | Hacker News Reader

I am surprised that the information got out. In my company any email attachments to addresses outside the company domain were automatically zipped and passworded at the mail-server.

We would then receive an email with the password which we have to then inform to the original recipient (usually by forwarding the email... MITM? What does that mean).

And this is for a company that is nowhere near as regulated. How did GS let this happen?

View on HN

Clearly someone in their infosec department just got fired. In the financial industry (I work in tech for finance), the "DLP" aka Data Loss Protection segment is very busy.

A few ideas: https://www.verdasys.com/solutions/eip.html

http://www.symantec.com/data-loss-prevention

http://interguardsoftware.com/sp_dlp_lnd_v6.html

http://technet.microsoft.com/en-us/library/jj150527(v=exchg....

DLP software is what keeps sensitive software inside the confines of where it is supposed to stay. Funnily enough, DLP software like exactly the stuff in those links is what was not installed in the base Edward Snowden was at in Hawaii because it used too much bandwith.

The Federal Reserve uses Verdasys to prevent digital copies of the plates that print money from making it out (I know a guy who works in their tech department). It is scary to work at a place where they don't always trust even their administrators who have root/Administrator privs.

Is such a setup able to figure out if I base64 or uuencode a file and include it as text inside of a plain text e-mail? I would think there'd always be a way around this somehow.

Yes. The software we use will actually log when you perform any sort of read on files matching certain strings (ie sensitive source codes).

One of our infosec guys encoded some sensitive source code and played it through the speaker to his phone and reconstructed it. The DLP software detected that and it was in a dashboard buried amongst other things.

That's the first time I've heard of that sort of setup. Very cool.

Huh, I thought it was quite common, my mistake.

It certainly worked but it was a total drag for normal users as we were constantly in communication with outside parties.

But then making us happy was not the goal of the software :D

The article doesn't mention the email contained an attachment. I've sent and received a lot of emails with confidential data in the form of people chatting, parts of a spreadsheet pasted in, or an entire HTML automated report.

That is a fair point, in fact a very fair point if this was part of some "reporting" thing, the text might have been embedded in the email itself.... (Which raises other questions though, like signing and encryption and storage etc)

> How did GS let this happen?

It was a glitch.

And there should have been a completely separate layer that would have caught the data sent by the glitch. To rephrase the question: "How did GS not have defense in depth here?"

Reply on news.ycombinator.com