Following Google Docs: Avoiding Corporate Document Leaks

[НСК-СБ]

Following Google Docs: Avoiding Corporate Document Leaks

The incident with the leak of documents from Google storage will force companies to reconsider approaches to the use of public services

At a plenary session of the International Congress on Cybersecurity on July 6, German Gref invited the expert community to answer the question from whom, in their opinion, the greatest cyber threat emanates. The most popular answer was: “From the custodians of personal information”: 44.3% of respondents think so. Much less information security experts are afraid of hackers and scammers (27.2%), government (19.0%) and other people (9.5%). The story of the Google Docs leak perfectly shows how right these 44.3% are.

In the evening of July 4, 2018, the Yandex search engine indexed Google Docs documents that were not protected by privacy settings. Leaks of various kinds have happened before, but this one got a wide response: a lot of sensitive corporate information got into the network, including lists of employees with their personal data and passwords from corporate resources. Many of the documents that were in the public domain were editable and vandalized.

Why did this happen? Statistics on confidential information leaks show that most of these incidents are not connected with malicious intent, but with an elementary human factor. A modern user is accustomed to convenience, and the corporate software market does not keep pace with the rapid development of technology and cannot promptly provide friendly interfaces for work.

The level of literacy in the field of information security among ordinary users is quite low. And if in the corporate environment this problem is understood and people are trying to further increase the literacy level, then in everyday life people follow the path of least resistance (weak passwords, default access settings, storing confidential information in public files, etc.) This leads to to the fact that many transfer their personal habits of using public services to the corporate environment and upload not only personal, but also confidential corporate files to the network, thereby enhancing the synergistic effect of information security threats, lowering the level of security of corporate processes and putting their personal data at risk compromise.

What does this mean for users? If company employees use public services for storing corporate documents and working with them, the responsibility for controlling the dissemination of information lies with them. Employees of government departments in Russia are prohibited in principle from using public services for storing service materials.

But the actions of employees do not relieve responsibility from the relevant departments of the company. When an enterprise begins to implement cloud services, it becomes much more difficult for it to control the distribution of service information, monitor non-standard user behavior and integrate the approaches used in an external cloud service into its corporate information security system.

In our experience, many companies even with a corporate subscription to public office services prefer to store and process documents in their own corporate network. Today, various software products are presented on the market that allow creating user-friendly secure corporate space with its own storage. Domestic security systems for a private cloud control access to data, check the strength of passwords, manage users and can be deployed even in systems of the highest class of protection. The use of these systems in a complex eliminates the possibility of mass erroneous distribution of service information outside the company.

The main recommendation for organizations that need to work with files at any time of the day from anywhere is to avoid storing and processing official documents in public clouds. Using public services is a direct way to increase the unmanageable risks of leakage, which can negate all the benefits.

I sincerely hope that this incident will force companies affected by recent events to make conclusions - to optimize their processes, provide control over the use of corporate services and software, as well as revise approaches to using public services.
Following Google Docs: Avoiding Corporate Document Leaks | Technology | Forbes.ru

 

[НСК-СБ]

The X-Files: how Yandex found Google user documents

Do you think that only Google Docs with access for everyone can become someone else’s prey? Log in to the VKontakte social network, select “Documents”, type in “passwords” and enjoy. The Russian Internet is a monument to human carelessness
At approximately 11:00 p.m. on July 4, the first news appeared in RuNet that Yandex would send out files contained in Google Drive in a search. Considering that users are now trying to store all documents in the cloud, quite important information came across: passwords from services, contacts of partners, and even incriminating evidence. Who's guilty? And most importantly, what to do in order not to suffer?

Option 1. Google
At the time of publication of the material, the Russian representative office of Google did not answer how it could happen that the personal files of users of the Disk service were in the public domain.

For a site to appear in the search, it must be indexed, the Yandex robot or another search engine visits the site and writes a “copy” of the site’s information with a pen in a notebook to understand in general what it can be searched for. Of course, this all happens in the digital world. The speed of indexing sites is limited by the performance of search engine servers - therefore, for example, Yandex looks better in RuNet, and Google searches among English-language sites, each focusing on its own segment.

The rules allow developers to disable the indexing of pages that should not appear in the search engine - the indexing rules for the site are written in the robots.txt file, which the search engine must check. If programmers made a mistake when creating or modifying it, then data that is not intended for public viewing may be made publicly available. It’s clear that for “Google Drive” the file has existed for a long time, and the data has got to the network only now, therefore we need to find out the reasons.

As it was already, in 2011 they were indexed at Yandex posts Megafon users sent from the site. Why is not Yandex to blame? After all, only he indexed the messages? It can be assumed that the Google search engine simply did not have time to reach them, but it was only a matter of time.

Option 2. Yandex
Still, it is suspicious why Yandex had not indexed messages in Google Drive before, and suddenly they were available? What changed? Do not suspect the Internet company of sabotage, as we already said, just at that moment the robot could get to the information.

But users report that it was possible to enter not only files with “for all” access rights, but also those that were accessible only by reference. No clear confirmations were found, but there is a hypothesis that smart algorithms overdid and used links opened by the Yandex browser, considering them to be publicly available information. This, of course, would be a gross blunder of the developers.

However, any developers are sometimes mistaken. At the beginning of the decade, a modification of security rules led to the fact that on Facebook was publicly available information that, according to the authors, only friends could see. Then Mark Zuckerberg managed to fight back, saying that the younger generation is more open and does not need privacy. However, with the growing popularity of the Facebook service, I was puzzled by the problem of data security - and the company will be disassembling the case with the scandal around Cambridge Analytica for a long time to come.

As a result, a few hours after the first reports of access to other people's materials, Yandex generally removed the ability to search for documents on docs.google.com. Even those that are in the public domain. At the same time, public files from Google Drive can be found on Google or other search services.

Companies are sometimes mistaken, but they are corrected, and all errors cannot be prevented. And much more often the problem on the other side of the screen is in the actions of the users themselves.

Option 3. And, I am afraid, the most correct
Many consider users guilty for one simple reason: “Everything that is posted on the Internet can be stolen.” I do not agree with this.

Indeed, any files can leak, passwords can be cracked, protection systems can be circumvented. But we have been living on the Internet for most of our lives. Carrying all the information with you, as well as synchronizing it on different devices, is simply unrealistic. Yes, and it’s not safe - if earlier robbers took money, now they can take away a flash drive with passwords from bank cards and mail.

We live in a digital world, and if you are not going to live in the forest as a hermit, you should not avoid the Internet, but study and use them.

What is your e-mail? Does it match the login in iCloud? Does it consist of the phone number to which your bank card is linked? If the answer is "Yes, it’s convenient." Then think that it is convenient not only for you.

Unfortunately, the interface is made by programmers, people with a technical mentality and logic that is not always obvious, for example, to users with a business vein or humanitarian abilities. Even the best interface will be brutally disfigured, while the project goes through all stages of coordination and completion. Worth the time, but study them.

Do you think that only Google Docs with access for everyone can become someone else’s prey? Enter the VKontakte network, select “Documents”, type “passwords” and enjoy. The Internet is a monument to human carelessness.

Tip 1 . Check the default privacy settings for documents in cloud services. It seems to you that they should be hidden from prying eyes, the service could decide otherwise. Check regularly that your privacy settings haven’t been lost.

Tip 2 . Perhaps this time information was also disclosed for documents with privacy settings “by reference”. Remember that this is the minimum level of protection. One careless user who received the link can share the information. You won’t even be able to check what kind of “unidentified deer” is in the document right now, and understand if the file has been left to strangers. Direct connection by e-mail is more reliable, and allows you to keep track of who made changes to the document.

Tip 3 . Do you really need a PIN from a bank card on its back and passwords from online banks in the cloud? Master password managers built into browsers or as separate applications - these are programs in which all the others can be encrypted with one password.

Can't remember your password? Think again. You can make a maiden name not of a mother, but of a grandmother. Add your nephew’s birthday (ok, at least a year), write back your most hated dish backwards and add the address of the neighboring house.

Use modern biometric methods of protection. Yes, a fingerprint can be faked, but it costs much more effort than picking up a link address or intercepting a password from your service.

Tip 4 . I do not believe that you cannot do without a list of passwords. But at least complicate the task of the thief. Write the PIN code from the card in your notebook to Grandma’s contact (put the operator code and the missing numbers “out of my head”). Elementary, do not write the username and password into one file - even if they leak, the attacker will have only half the code in his hands. And most importantly.

Stop hoping that companies will do everything for you. Even the longest and most complex password that is used on several services can be thrown out if you enter it under a surveillance camera. Master the modern possibilities of protecting your data. The Internet has given us a new world. Do not forget to master the instructions for its use.
The X-Files: how Yandex found Google users' documents | Technology | Forbes.ru