How can I lock down a file?

[mogul]

We have very sensitive information stored on various Excel files which are used by staff every day.

If any member of staff wished to be a bit naughty or left the company they could simply email or upload/download to their home computer information which could prove useful to the competition. How can I lock down these files so they can't be emailed out of the company or transferred using FTP?

We regularly transfer very large files to various suppliers so I can't have a limit on the physical size of a file. For example I had thought of hiding a 100mb file in every spreadsheet to make it difficult to email, but we shift files in excess of that daily using ftp.

I have spoken to our IT Solution company but they seem unsure and can't suggest an answer.

Anyone got any ideas?

[arcturus]

Even if you lock down email and ftp, could they not use a memory stick or burn to a cd or are those methods already locked down?

[mogul]

arcturus said:

Even if you lock down email and ftp, could they not use a memory stick or burn to a cd or are those methods already locked down?

Can't lock down email or ftp due to the requirement to send artwork to various suppliers.

I can lock down ports and the email will only send up to 10mb.

FTP worries me, they could even create an ftp folder on the server, load the files and then log on from home and drag them down...

[UpTheIron]

There is likely to be a way around any security control, and / or an impact to productivity as a result of them.

That said, the simple answer is that you can control pretty much what you want, but how much is it worth to you?

[TurricanII]

You, or rather your IT department, needs to tighten up on lots of areas:
- stop ALL traffic from user PC's from getting directly out to the web using a firewall
- use a proxy server for all web traffic to go out through, with logging
- restrict web access to necessary staff
- disable cd writers, floppies and USB ports for non-administrators
- Have a catch all mailbox which is archived off regularly and kept so that all email in/out of the company is catalogued - even if usrs delete their sent items
- restrict access to the FTP server folders internally (from staff) and externally with usernames for authorised people only - turn on auditing of access
- restrict access to your sensitive XL files with only necessary staff having access using permissions on your files and folders
- Have an 'acceptable usage policy' for I.T. - GET ALL USERS TO SIGN A COPY ASAP!! Have the AUP detail that staff members should not use personal email when at work. Include a polict that all email belongs to the company and may be read at any time.

You can go to any level, if you have a decent IT agent to advise you.

[mogul]

TurricanII said:

You, or rather your IT department, needs to tighten up on lots of areas:
- stop ALL traffic from user PC's from getting directly out to the web using a firewall
- use a proxy server for all web traffic to go out through, with logging
- restrict web access to necessary staff
- disable cd writers, floppies and USB ports for non-administrators
- Have a catch all mailbox which is archived off regularly and kept so that all email in/out of the company is catalogued - even if usrs delete their sent items
- restrict access to the FTP server folders internally (from staff) and externally with usernames for authorised people only - turn on auditing of access
- restrict access to your sensitive XL files with only necessary staff having access using permissions on your files and folders
- Have an 'acceptable usage policy' for I.T. - GET ALL USERS TO SIGN A COPY ASAP!! Have the AUP detail that staff members should not use personal email when at work. Include a polict that all email belongs to the company and may be read at any time.

You can go to any level, if you have a decent IT agent to advise you.

We have pretty much all of the above. I have recently appointed Mentor Services to review our T&C's etc and that will include all aspects of internet use.

It appears we are probably doing what we can and I have to hope the worst doesn't happen.

I could invest in POP but know very little about that.

[GreenV8S]

Don't give them direct access to the file, provide an application (perhaps a simple web service) that does the same job. That way the only access they have to the data is to look at it on the screen and copy/paste what they're seeing into another document. The application design will determine how much data they can access at once which determines how much hassle they would have to go through to copy the whole lot. There are ways that you can make it even harder for them to export the data, but I suspect that's overkill for your needs. If there's a trust issue or the data is business critical or particularly valuable then allowing *anyone* direct access it is a bad move, the data should be under change control.

[mogul]

GreenV8S said:

Don't give them direct access to the file, provide an application (perhaps a simple web service) that does the same job. That way the only access they have to the data is to look at it on the screen and copy/paste what they're seeing into another document. The application design will determine how much data they can access at once which determines how much hassle they would have to go through to copy the whole lot. There are ways that you can make it even harder for them to export the data, but I suspect that's overkill for your needs. If there's a trust issue or the data is business critical or particularly valuable then allowing *anyone* direct access it is a bad move, the data should be under change control.

This sounds promising.

The excel files are essentially our day to day order books.

We use Line 50 for accounting but a pretty basic order entry system. The other alternative I suppose is to use Line 50 from enquiry right through to invoicing. We'd have a massive task creating product codes as there are so many variables but it would make data more secure.

It amazes me that in an age where a lot of businesses have sensitive data of various kinds, it can still be copied or sent via email.

[Jubal]

mogul said:

GreenV8S said:

Lots of sensible stuff.

This sounds promising.
.
.
.
It amazes me that in an age where a lot of businesses have sensitive data of various kinds, it can still be copied or sent via email.

You need to sack off whomever is advising you and find someone else to deal with. Anyone half decent would've sorted things out as suggested by GreenV8S. There's no need to expose yourself to risk if you have the budget to sort it.

[mogul]

GreenV8S said:

Don't give them direct access to the file, provide an application (perhaps a simple web service) that does the same job. That way the only access they have to the data is to look at it on the screen and copy/paste what they're seeing into another document. The application design will determine how much data they can access at once which determines how much hassle they would have to go through to copy the whole lot. There are ways that you can make it even harder for them to export the data, but I suspect that's overkill for your needs. If there's a trust issue or the data is business critical or particularly valuable then allowing *anyone* direct access it is a bad move, the data should be under change control.

If I understand you, I could still get the spreadsheet as a viewable and changeable file but through the company Intranet, making it very difficult to copy and send/email/ftp out deliberately?

[dilbert]

At the end of the day, it's always going to be possible to get it out somehow, especially if it's excel, with macros and whatnot.

As an example, I can write a DLL which I could call into from excel and it would strip the content of the spreadsheet from within excel, rather than from the file. Another way to do it, is through the clipboard, but an excellent medium for this kind of thing is a good old fashioned printout.

This isn't some sort of oneupmanship thing, I'm just trying to show that the best you're ever likely to do is have two classes of user, the ones who can use that particular data, and the ones who can't.

The existing mechanisms for user access to files, will do all you can within your environment. Where data needs to leave your controlled environment, then existing mechanisms for file encryption are key.

What you can never prevent, is someone who has access to critical data duplicating it by an infinite plethora of means and taking it where they will.

If the data is that critical, split it up, and have more than one person work on it. No one person, other than perhaps yourself, should have access to all the data, but each has access to their part.

This is one of the best risk mitigation strategies when it comes to data security, but it will always have in impact on the capability of your organisation, and it's response time.

Clearly another really good mitigation strategy is computer automation. Eliminate untrusted humans. That strategy has the potential to improve your organisations performance above that of your manual competitors, whilst remaining secure.

Critically if your competitors decide to automate too, then the secure system will always have a greater limitation of performance. They could still outclass you.

Information is naturally meant to be free!

[GreenV8S]

mogul said:

If I understand you, I could still get the spreadsheet as a viewable and changeable file but through the company Intranet, making it very difficult to copy and send/email/ftp out deliberately?

No; I'm saying that nobody should have direct access to the spreadsheet. They should be given access to the whatever parts of the data in it that they need to do their job, and this access should be controlled by an application which ensures that they can only access the parts of the data you want them to, and that you can control and track changes to it.

[Workshy Fop]

What about using mailsweeper to block sending of attachments of type .XLS. Our one is clever enough to read the file header itself so doesn't matter if you rename the file it'll still get rejected. Also bounce encrypted emails too so that if, for examnple, they .zip it up and password it, it'll just get bounced. Consider blocking webmail services eg. hotmail, gmail etc.

You also need some form of encryption where the files themselves are stored, what happens if someone nicks the PC it's on? The encryption with XP Pro is fine for this.

[Conian]

Do you work at Ferrari?

[Workshy Fop]

Eh? Non.....

[dilbert]

All all one would need to do to get around that is to uuencode (or something similar) and send the file as plain text..... I suppose you could block plain text e-mail.

[GnuBee]

GreenV8s has the solution - don't provide access to the file/spreadsheet provide access to the data contained therein via a web application/service.

If you current IT solution company either a) didn't suggest this or b) can't do it then I'm afraid they're not a solution company at all...

[mogul]

GnuBee said:

GreenV8s has the solution - don't provide access to the file/spreadsheet provide access to the data contained therein via a web application/service.

If you current IT solution company either a) didn't suggest this or b) can't do it then I'm afraid they're not a solution company at all...

It's been discussed today and the excel data will be re-written as a database file which will achieve a similar file to the existing and then accessed via the intranet making it very difficult if not impossible to send out.

Not sure of the exact details but I'm assured my concerns will be addresses.

Thanks for your help guys