this post was submitted on 27 Nov 2024
130 points (96.4% liked)
Linux
48376 readers
1007 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This is the only reliable solution. To expand:
The real answer is you are probably screwed without investing a bunch of time, effort, and cost.
You might get away with more basic security measures if the user has very limited IT knowledge.
I suggest getting legal advice before you give the user access to your data in the manner you intend.
Windows is absolutely more difficult to secure than linux. I can restrict access down to the kernel level in linux. Windows has no such granularity
"Easy" from the point of view there a lots of off the shelf tools to help you do it that are easy to understand.
DLP solutions are honestly a joke. 99% of the case they only cost you a fortune and prevent nothing. DLP is literally a corporate religion.
What you mentioned also makes sense if you are windows shop running AD. If you are not, setting it up to lock 1 workstation is insane.
Also, the moment the data gets put on the workstation you failed. Blocking USB is still a good idea, but does very little (network exfiltration is trivial, including with DLP solutions). So the idea to use remotely a machine is a decent control, and all efforts and resources should be put in place to prevent data leaving that machine. Obviously even this is imperfect, because if I can see the data on my screen I can take a picture and OCR it. So the effort needs to go in ensuring the data is accessed on a need basis.
That was kinda my point. Securing a laptop that will have access to data you want to protect from loss is a near bottomless pit of issues. There comes a point you have to do a risk assessment and apply a level of security that meets your legal requirements and contractual obligations. I'm sure this is all doable on Linux as well but the low cost / easily available tools are mostly for Windows.
I suspect that taking the "secured remote session" approach is probably good enough for their needs. It just needs a client app you can trust to respect the security rules they want to enforce (no screen shots, no screen recording, no data transfers for any sort, etc).
OCRing what is on screen is not really stoppable unless you force them to keep their camera on so you can monitor them 24/7. But if you try hard enough there is usually a way around most security measures.
Either way, they need to decide what the risk impact vs likelihood profile is, and what the business can tolerate. They'll need to discuss it with legal and data protection folks to assess that.
One tip is to embed records and values that look meaningful, but are unique, into the copy of the data given to the specific employee. This can be used to potentially prove that a data breach was a result of something that employee did. We like to put QUID's as invisible watermarks in document headers. These trigger our DLP systems which is always funny cos its usually an employee who is leaving and wants to keep something. I love those conversions.