Classified U.S. military info, corporate data available over P2P
Inadvertent data leakage worse than thought, experts tell Congress
Computerworld - Millions of documents, both governmental and private, containing sensitive and sometimes classified information, are floating about freely on file-sharing networks after being inadvertently exposed by individuals downloading peer-to-peer (P2P) software on systems that held the data, members of a House committee were told yesterday.
The documents exposed included the Pentagon's entire secret backbone network infrastructure diagram, complete with IP addresses and password change scripts; contractor data on radio frequency manipulation to beat improvised explosive devices (IED) in Iraq; physical terrorism threat assessments for three major U.S cities; and information on five separate U.S. Department of Defense information security system audits.
Information about the breach came during a hearing on inadvertent file sharing over P2P networks held by the House Committee on Oversight and Government Reform chaired by Rep. Henry Waxman, (D-Calif.). One of those testifying was retired Gen. Wesley Clark, who is currently a board member of Tiversa Inc., a company that sells P2P network monitoring services to government agencies and private-sector companies.
Clark described how "in a matter of hours" he was able to lay hands on over 200 documents containing classified and secret government data from P2P networks using Tiversa's search engine. He came across the documents while preparing for the hearing.
Some of the data appears to have come from the system of a contract worker at the Pentagon who installed P2P software on her computer, Clark said. The data included everything from Iraq status reports to a list of soldiers with their Social Security numbers. "They are the complete documents. They are not faxed copies. They are not smudged. They are as fresh as if they were printed off the computer" of the organization they came from," he said.
"There's all kind of data leaking out inadvertently," Clark told the committee, noting that the documents he cited were "simply what we found when we put the straw in the water. The American people would be outraged if they are aware of what is being inadvertently being disclosed on P2P networks."
It's not just government data that is leaking out; so is a lot of sensitive corporate information, said Robert Boback, the CEO at Tiversa who also testified at the hearing. In written testimony, Boback listed several examples of corporate information that Tiversa was able to pull from P2P networks. It found, for instance, the board minutes of one of the world's largest financial services organizations, the entire foreign exchange trading backbone of a financial company and a comprehensive launch plan -- complete with growth targets -- of yet another financial company that was diversifying into a new region. Other corporate documents retrieved from P2P networks included press releases not yet issued, patent information, business contracts and nondisclosure agreements.
- Top 10 Reasons to Strengthen Information Security with Desktop Virtualization Regain control and reduce risk without sacrificing business productivity and growth
- Preventing Sophisticated Attacks: Anti-Evasion & Advanced Evasion Techniques McAfee Next Generation Firewall applies sophisticated analysis techniques specifically to detect advanced evasion techniques (AET).
- The Security Industry's Dirty Little Secret The debate over advanced evasion techniques (AETs) This report summarizes the findings of a McAfee commissioned research group to determine the level of understanding IT security professionals have about AETs...
- Demand More, Get the Most from the Move to a Next-Generation Firewall Beyond the basics in a next generation firewall, to protect your investment you should demand other valuable features: intrusion prevention, contextual rules, advanced...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!