Software Engineering Institute | Carnegie Mellon University
Software Engineering Institute | Carnegie Mellon University

Digital Library

Javascript is currently disabled for your browser. For an optimal search experience, please enable javascript.

Advanced Search

Basic Search

Content Type

Topics

Publication Date

Technical Note

Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection

  • Abstract

    Web-based services, such as email, are useful for communicating with others either within or outside of an organization; however, they are a common threat vector through which data exfiltration can occur. Despite this risk, many organizations permit the use of web-based services on their systems. Implementing a method to detect and prevent data exfiltration through these channels is essential to protect an organization's sensitive documents.

    This report presents methods that can be used to detect and prevent data exfiltration using a Linux-based proxy server in a Microsoft Windows environment. Tools such as Squid Proxy, Clam Antivirus, and C-ICAP are explored as means by which information technology (IT) professionals can centrally log and monitor web-based services on Microsoft Windows hosts within an organization. Also introduced is a Tagger tool developed by the CERT Insider Threat Center that enables information security personnel to quickly insert tags into documents. These tags can then be used to create signatures for use on the proxy server to prevent documents from leaving the organization. In addition, the use of audit logs is also explored as an aid in determining whether sensitive data may have been uploaded to an internet service by a malicious insider.

  • Download

Cite This Report

SEI

Silowash, George; Lewellen, Todd; Burns, Joshua; & Costa, Daniel. Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection (CMU/SEI-2013-TN-012). Software Engineering Institute, Carnegie Mellon University, 2013. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=40224

IEEE

Silowash. George, Lewellen. Todd, Burns. Joshua, and Costa. Daniel, "Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Note CMU/SEI-2013-TN-012, 2013. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=40224

APA

Silowash, George., Lewellen, Todd., Burns, Joshua., & Costa, Daniel. (2013). Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection (CMU/SEI-2013-TN-012). Retrieved December 21, 2014, from the Software Engineering Institute, Carnegie Mellon University website: http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=40224

CHI

George Silowash, Todd Lewellen, Joshua Burns, & Daniel Costa. Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection (CMU/SEI-2013-TN-012). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2013. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=40224

MLA

Silowash, George., Lewellen, Todd., Burns, Joshua., & Costa, Daniel. 2013. Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection (Technical Report CMU/SEI-2013-TN-012). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=40224