Chapter 9: Data Leaks--Exploiting Egress

Overview

There are a myriad of mistakes to be made that can unwittingly allow an individual to remove data from your network. The scope of this book doesn't cover physical controls, data retention and destruction policy, or even specific techniques for client-based data security. This chapter focuses on minimum network controls that we believe should be put into place to avoid many forms of unintended information disclosure related to the network infrastructure itself. By this we mean the ability to easily remove data from employee desktop computers, creating pin-up tunnels to be used for subsequent infiltration and other activities, and planting "phone home" agents that allow for the attacker to be contacted by your network at a later date.

This chapter will provide information on the following:

• Egress Exploitation Background and Function A brief explanation of egress and the often-overlooked problems with allowing any internally initiated connections to flow in and out of your network without scrutiny.

• Exposing Weaknesses in Firewall Policy and Routing How the packet filtering rules we put in place for convenience lower the bar for attackers .

• Reclaiming Control over Egress How you can alter your packet filtering strategy to make your network a bigger pain to infiltrate than the next guy's.