Maintaining Digital Certificate Security

Re:Maintaining Digital Certificate Security by kjs3 on Monday March 23, 2015 @10:50PM (#9254624)

Simple answer: Yes, they basically check every packet, or at least as many as they can. No, DLP isn't perfect, and it doesn't always work. This should not be a shocker.

Notes:

1) Modern DLP solutions have some pretty sophisticated obfuscation detection tech. Like almost all of these kinds of technologies, they're looking for the 80% case, not the 99% case.

2) Tunneling out encrypted tunnels is subject to traffic analysis techniques. It's not as uncommon as one might suspect to detect out-of-band ex-filtration of many different types this way.

[ Parent | on HN ]

Re:Maintaining Digital Certificate Security by angry_octet on Tuesday March 24, 2015 @05:00AM (#9255496)

Please, point out any systems which have believeable claims for doing this. In my experience most 'DLP' systems do no such thing, they are just like the bit of string which stops you stealing pens at the bank, basically theatre.

Automatic analysis to statistically detect hidden channels is a research topic, it can be used to put bounds on the exfil rate but not reliably detect it.

[ Parent | on HN ]

Re:Maintaining Digital Certificate Security by jsprogrammer on Monday March 23, 2015 @11:21PM (#9254718)

I guess my hangup was on the claim that such a scheme could 'ensure' prevention of ex-filtration which, frankly, seemed laughably impossible.

[ Parent | on HN ]