Возможности КИБ Searchinform

Total Page:16

File Type:pdf, Size:1020Kb

Возможности КИБ Searchinform SEARCHINFORM DLP CAPABILITIES 2 Contents SearchInform DLP Capabilities ............................................................................... 3 1 Capabilities of EndpointController Interception Modules for Windows ............. 3 2 Capabilities of NetworkController Interception Modules .................................. 8 3 Capabilities of NetworkController Integration with Mail Servers, Lync (Skype for Business) and ISA/TMG .................................................................................. 10 4 Capabilities of EndpointController Interception Modules for Linux (Ubuntu, CentOS, Rosa, Gos, Astra) .................................................................................... 11 5 Blocking Capabilities in SearchInform DLP .................................................... 12 5.1 Blocking at the Level of Agent ....................................................................... 12 5.2 Blocking at the Level of Network ................................................................... 13 5.3 Blocking Email at the Level of Workstation or Mail Server (Agent) ..................... 14 6 Protection of Data at Rest .............................................................................. 15 3 SEARCHINFORM DLP CAPABILITIES SearchInform Data Loss Prevention (SearchInform DLP) is used to collect and analyse information flows within the local computer network. Data can be captured in two ways, depending on the server component: SearchInform EndpointController or SearchInform NetworkController. Server components are the platforms on which data interception modules operate. Each interception module operates as a traffic analyzer and controls its own data transmission channel. This document provides detailed capabilities of interception modules of SearchInform DLP server components. 1 CAPABILITIES OF ENDPOINTCONTROLLER INTERCEPTION MODULES FOR WINDOWS The table shows capabilities of SearchInform EndpointController that operates through agents installed on network workstations. Module Features Capabilities Filtration for Users/Groups or processes Capability to exclude system actions 1. Capturing key strokes Capability to exclude interception of 2. Capturing function keys passwords KeyLogger 3. Capturing text from Blocking PrintScreen keystroke clipboard Interception of only keyboard keys/clipboard/all Set up of clipboard size Filtration for Users/Groups or processes Capability to exclude system actions Control of any event of file system FileController (creating, changing, opening, Audit of changes of file/folder access deleting, etc.) for files or folders rights Capability to exclude audit of temporary MS Office files 1. Taking snapshots Capability to set up interval for taking 2. Recording video snapshots, options of video recording, CameraController 3. Connecting to camera in real particular options for selected time applications, users, URLs 1. Google Docs 2. OneDrive 3. Office 365 4. Dropbox 5. Evernote Cloud & 6. Yandex.Disk N/a SharePoint 7. Cloud.mail.ru 8. Amazon S3 9. iCloud 10. DropMeFiles 11. OwnCloud 12. SharePoint Maximum size of a captured file, update FTPController Capturing files sent over FTP protocol interval, timeouts of last activity 4 Module Features Capabilities Control of time spent in applications and on websites Control of time spent on websites is possible in the following browsers: Internet Explorer (from version 8) Mozilla Firefox (from version 50.1.0) Google Chrome (from version 55.0.2883.87) Yandex Browser (16.11.0.2680) Opera (Presto) (36.0.2130.80) Opera (Chromium) Safari Tor Browser Netscape Navigator Filtration for Users/Groups or processes Amigo (from version Capability to exclude system actions ProgramController 54.0.2840.189) Capability to disable audit of activity on Sputnik (from version websites 2.1.1051.0) Flock (02.06.2001) Avant Browser Lunascape Maxthon SeaMonkey K-Meleon SlimBrowser Edge (from version 38.14) Comodo Dragon (from version 52.15.25.664) CoolNovo (2.0.9.20) Cốc Cốc (from version 56.3.150) Titan Browser (from version 33.0.1712.0 (235591) Uran (from version 43.0.2357.134) Options of quality (compression) for 1. Control of printing on local images printers Filtration by users, processes, 2. Control of printing on PrintController description, printer, and location network printers 3. Control of printing on virtual Feature of blocking Escape functions printers (control of a printer by escape commands) Limitation by minimum size of POST query Limitation by intercepted nodes, IP addresses, ports, type (SSL/no SSL), 1. Capturing POST queries HTTPController processes 2. Capturing GET queries Capability to add a list of anonymizers Capability to block SPDY and QUIC Capability to exclude MIME types (audio, video, images) 5 Module Features Capabilities Capability to set up interval of taking screenshots, interval of taking screenshots of Skype video conferences and for URLs, particular options for selected applications, users; color 1. Taking screenshots settings, settings for several monitors 2. Videorecording user’s MonitorController actions Capability to adjust color and exclude 3. Connecting to a user’s background; frame frequency settings screen in real-time mode Capability to configure a schedule and operating mode (for all/for selected) Capability to specify access settings for connection by password or for specified users Capability to specify settings for profiles In Office/Out of Office: maximum 1. Sound recording with a duration, noise reduction, quality of microphone recording, speech recognition, list of 2. Connecting to a user’s software, schedule MicrophoneController microphone in real-time Capability to configure a schedule of mode recording 3. Audio recognition (speech- to-text transcription) Capability to specify access settings for connection by password or for specified users Interception of the following protocols: IMAP MAPI (without encryption) POP3 SMTP General settings: NNTP Filtration by sender, recipient, domain WebMail as part of: user, subject, protocol, size, number of mail.ru recipients MailController gmail.com tut.by Individual settings for WebMail: yandex.ru capability to activate/deactivate rambler.ru interception of incoming email messages outlook.com Blocking outgoing (SMTP) email office 365 messages by content and/or context ukr.net criteria yahoo.com qip.ru Google Sync Etc. 6 Module Features Capabilities Interception of the following protocols: 1. ICQ 2. MMP (mail.ru agent) 3. XMPP (Jabber) 4. MSN 5. Gadu-Gadu Interception of contact list 6. Lync Capturing chats, calls, files, contact; 7. Viber settings of maximum file size, sound and 8. Telegram duration 9. HTTPIM as part of: Capturing chats, calls, files, contacts, IMController vk.com ok.ru message history; settings of maximum facebook.com file size, sound and duration mamba.ru Audio recognition (speech-to-text my.mail.ru transcription) LinkedIn Evernote Google+ Yammer Fotostrana Web-Skype icq.com etc. Capturing chats, calls, files, contacts, SMS, message history Capturing calls, messages, files, SMS Settings of maximum file size, sound and SkypeController via Skype for desktop duration Audio recognition (speech-to-text transcription) 7 Module Features Capabilities a) Audit + Block of Access: General capabilities: 1. USB HID devices (except Maximum size of a processed keyboard and mouse) file 2. Printers (USB) Exclusion of system users 3. Bluetooth adapters (USB) Black and white lists by type, 4. Scanners (USB) device, manufacturer, serial 5. All USB devices (except number, user, computer concentrators) 6. COM ports 7. LPT ports Capabilities for A group: 8. Bluetooth Users/Groups 9. Printers Computers 10. IR ports Full right access/No access 11. Media devices Audit On/Off 12. HID devices (except Exclusion of system users keyboard and mouse) 13. Keyboard and mouse 14. FireWire 15. Smart cards Capabilities for B group: 16. PDA Users/Groups 17. Tape device Computers 18. Block of folders 19. Block of disks Full right access/No access b) Only block of access: 1. Modems Capabilities for C and D groups: 2. Wi-Fi Capabilities described above, as well as: c) Audit + Block of access + Shadow Shadow copy by file name, file copy: type, process, user, computer DeviceController 1. USB devices Access by file name, file type, process, user, and computer 2. CD/DVD-ROM Shadow copy of data stored on 3. Cameras/Scanners device 4. Floppy disks 5. SCSI 6. Network folders 7. RDP disks 8. Portable devices of Windows Android Apple Blackberry Palm Windows Phone All portable devices d) Available blockings: 1. USB devices 2. Block at the start of software 3. CD/DVD-ROM 4. Floppy disks 5. SCSI 6. Network folders 7. Clipboard 8. RDP disks 9. Portable devices of Windows 10. Processes 8 Module Features Capabilities Encryption is available for selected users or groups For encrypted files you can configure access settings for: • All users except specified • Only specified users Encryption of all data types sent to Data encryption external USB storage devices using a A file can be opened only if agent is unique key (generated by user) available and there is a permission to open Black/white list settings are also available for encryption You can configure settings of shadow copy, where ONLY encrypted files will be captured Automatic addition of such connections in Notifications about failed attempts of exclusions SSL notifications agents to trap connection1 Filtration by time, computer, user, process, and type Audit of technical
Recommended publications
  • TR-SBA-Research-0512-01: Fast and Efficient Browser Identification With
    Fast and Efficient Browser Identification with JavaScript Engine Fingerprinting Technical Report TR-SBA-Research-0512-01 Martin Mulazzani∗, Philipp Reschl; Markus Huber∗, Manuel Leithner∗, Edgar Weippl∗ *SBA Research Favoritenstrasse 16 AT-1040 Vienna, Austria [email protected] Abstract. While web browsers are becoming more and more important in everyday life, the reliable detection of whether a client is using a specific browser is still a hard problem. So far, the UserAgent string is used, which is a self-reported string provided by the client. It is, however, not a security feature, and can be changed arbitrarily. In this paper, we propose a new method for identifying Web browsers, based on the underlying Javascript engine. We set up a Javascript confor- mance test and calculate a fingerprint that can reliably identify a given browser, and can be executed on the client within a fraction of a sec- ond. Our method is three orders of magnitude faster than previous work on browser fingerprinting, and can be implemented in just a few hun- dred lines of Javascript. Furthermore, we collected data for more than 150 browser and operating system combinations, and present algorithms to calculate minimal fingerprints for each of a given set of browsers to make fingerprinting as fast as possible. We evaluate the feasibility of our method with a survey and discuss the consequences for user privacy and security. This technique can be used to enhance state-of-the-art session management (with or without SSL), as it can make session hijacking considerably more difficult. 1 Introduction Today, the Web browser is a central component of almost every operating sys- tem.
    [Show full text]
  • Comodo System Cleaner Version 3.0
    Comodo System Cleaner Version 3.0 User Guide Version 3.0.122010 Versi Comodo Security Solutions 525 Washington Blvd. Jersey City, NJ 07310 Comodo System Cleaner - User Guide Table of Contents 1.Comodo System-Cleaner - Introduction ............................................................................................................ 3 1.1.System Requirements...........................................................................................................................................5 1.2.Installing Comodo System-Cleaner........................................................................................................................5 1.3.Starting Comodo System-Cleaner..........................................................................................................................9 1.4.The Main Interface...............................................................................................................................................9 1.5.The Summary Area.............................................................................................................................................11 1.6.Understanding Profiles.......................................................................................................................................12 2.Registry Cleaner............................................................................................................................................. 15 2.1.Clean.................................................................................................................................................................16
    [Show full text]
  • HTTP Cookie - Wikipedia, the Free Encyclopedia 14/05/2014
    HTTP cookie - Wikipedia, the free encyclopedia 14/05/2014 Create account Log in Article Talk Read Edit View history Search HTTP cookie From Wikipedia, the free encyclopedia Navigation A cookie, also known as an HTTP cookie, web cookie, or browser HTTP Main page cookie, is a small piece of data sent from a website and stored in a Persistence · Compression · HTTPS · Contents user's web browser while the user is browsing that website. Every time Request methods Featured content the user loads the website, the browser sends the cookie back to the OPTIONS · GET · HEAD · POST · PUT · Current events server to notify the website of the user's previous activity.[1] Cookies DELETE · TRACE · CONNECT · PATCH · Random article Donate to Wikipedia were designed to be a reliable mechanism for websites to remember Header fields Wikimedia Shop stateful information (such as items in a shopping cart) or to record the Cookie · ETag · Location · HTTP referer · DNT user's browsing activity (including clicking particular buttons, logging in, · X-Forwarded-For · Interaction or recording which pages were visited by the user as far back as months Status codes or years ago). 301 Moved Permanently · 302 Found · Help 303 See Other · 403 Forbidden · About Wikipedia Although cookies cannot carry viruses, and cannot install malware on 404 Not Found · [2] Community portal the host computer, tracking cookies and especially third-party v · t · e · Recent changes tracking cookies are commonly used as ways to compile long-term Contact page records of individuals' browsing histories—a potential privacy concern that prompted European[3] and U.S.
    [Show full text]
  • The Artist's Emergent Journey the Metaphysics of Henri Bergson, and Also Those by Eric Voegelin Against Gnosticism2
    Vol 1 No 2 (Autumn 2020) Online: jps.library.utoronto.ca/index.php/nexj Visit our WebBlog: newexplorations.net The Artist’s Emergent Journey Clinton Ignatov—The McLuhan Institute—[email protected] To examine computers as a medium in the style of Marshall McLuhan, we must understand the origins of his own perceptions on the nature of media and his deep-seated religious impetus for their development. First we will uncover McLuhan’s reasoning in his description of the artist and the occult origins of his categories of hot and cool media. This will prepare us to recognize these categories when they are reformulated by cyberneticist Norbert Wiener and ethnographer Sherry Turkle. Then, as we consider the roles “black boxes” play in contemporary art and theory, many ways of bringing McLuhan’s insights on space perception and the role of the artist up to date for the work of defining and explaining cyberspace will be demonstrated. Through this work the paradoxical morality of McLuhan’s decision to not make moral value judgments will have been made clear. Introduction In order to bring Marshall McLuhan into the 21st century it is insufficient to retrieve his public persona. This particular character, performed in the ‘60s and ‘70s on the global theater’s world stage, was tailored to the audiences of its time. For our purposes today, we’ve no option but an audacious attempt to retrieve, as best we can, the whole man. To these ends, while examining the media of our time, we will strive to delicately reconstruct the human-scale McLuhan from what has been left in both his public and private written corpus.
    [Show full text]
  • Instrumentalizing the Sources of Attraction. How Russia Undermines Its Own Soft Power
    INSTRUMENTALIZING THE SOURCES OF ATTRACTION. HOW RUSSIA UNDERMINES ITS OWN SOFT POWER By Vasile Rotaru Abstract The 2011-2013 domestic protests and the 2013-2015 Ukraine crisis have brought to the Russian politics forefront an increasing preoccupation for the soft power. The concept started to be used in official discourses and documents and a series of measures have been taken both to avoid the ‘dangers’ of and to streamline Russia’s soft power. This dichotomous approach towards the ‘power of attraction’ have revealed the differences of perception of the soft power by Russian officials and the Western counterparts. The present paper will analyse Russia’s efforts to control and to instrumentalize the sources of soft power, trying to assess the effectiveness of such an approach. Keywords: Russian soft power, Russian foreign policy, public diplomacy, Russian mass media, Russian internet Introduction The use of term soft power is relatively new in the Russian political circles, however, it has become recently increasingly popular among the Russian analysts, policy makers and politicians. The term per se was used for the first time in Russian political discourse in February 2012 by Vladimir Putin. In the presidential election campaign, the then candidate Putin drew attention to the fact that soft power – “a set of tools and methods to achieve foreign policy goals without the use of arms but by exerting information and other levers of influence” is used frequently by “big countries, international blocks or corporations” “to develop and provoke extremist, separatist and nationalistic attitudes, to manipulate the public and to directly interfere in the domestic policy of sovereign countries” (Putin 2012).
    [Show full text]
  • Background Setup
    1.5.09 [email protected] Mechanical Turk/Browser Ballot Findings Background To compliment the testing and research done by Critical and Patrick Finch in Europe, I conducted a series of tests on Amazon’s Mechanical Turk to try out various aspects of the EC's Ballot design. The goal is to determine both how to design the ballot in the most neutral way possible, and for Mozilla to determine the most successful summary and image for the Firefox section of the ballot. I used MT because it’s a very fast and cheap way to get a design in front of many eyes. And the responses that came back were very good; users spent an average of 2.8 minutes on a five- minute test, and gave complete answers to free-form questions. A few drawbacks of the test were: • Users tended to be more highly-technical than average • Users tended to have heard of Firefox and already have a favorable opinion about it • MT did not provide a way to filter results by country, and many users were in North America as a result Because of the above problems, the MT tests are not the best sample of users that are similar to those seeing the ballot in Europe. However, their answers still provided some insight into why people use what browsers, what factors would make them switch, and what presentations of Firefox’s brand and motto would be most compelling. Setup The MT tests were given in three phases. In all of these test, various demographics questions such as what browser the user was running and where they live were asked.
    [Show full text]
  • HOLT Earth Science
    HOLT Earth Science Directed Reading Name Class Date Skills Worksheet Directed Reading Section: What Is Earth Science? 1. For thousands of years, people have looked at the world and wondered what shaped it. 2. How did cultures throughout history attempt to explain events such as vol- cano eruptions, earthquakes, and eclipses? 3. How does modern science attempt to understand Earth and its changing landscape? THE SCIENTIFIC STUDY OF EARTH ______ 4. Scientists in China began keeping records of earthquakes as early as a. 200 BCE. b. 480 BCE. c. 780 BCE. d. 1780 BCE. ______ 5. What kind of catalog did the ancient Greeks compile? a. a catalog of rocks and minerals b. a catalog of stars in the universe c. a catalog of gods and goddesses d. a catalog of fashion ______ 6. What did the Maya track in ancient times? a. the tides b. the movement of people and animals c. changes in rocks and minerals d. the movements of the sun, moon, and planets ______ 7. Based on their observations, the Maya created a. jewelry. b. calendars. c. books. d. pyramids. Copyright © by Holt, Rinehart and Winston. All rights reserved. Holt Earth Science 7 Introduction to Earth Science Name Class Date Directed Reading continued ______ 8. For a long time, scientific discoveries were limited to a. observations of phenomena that could be made with the help of scientific instruments. b. observations of phenomena that could not be seen, only imagined. c. myths and legends surrounding phenomena. d. observations of phenomena that could be seen with the unaided eye.
    [Show full text]
  • Detecting and Analyzing Insecure Component Integration
    Taeho Kwon December 2011 Computer Science Detecting and Analyzing Insecure Component Integration Abstract Component technologies have been widely adopted for designing and engineering software ap- plications and systems, which dynamically integrate software components to achieve desired func- tionalities. Engineering software in a component-based style has significant benefits, such as im- proved programmer productivity and software reliability. To support component integration, oper- ating systems allow an application to dynamically load and use a component. Although developers have frequently utilized such a system-level mechanism, programming errors can lead to insecure component integration and serious security vulnerabilities. The security and reliability impact of component integration has not yet been much explored. This dissertation systematically investigates security issues in dynamic component integration and their impact on software security. On the conceptual level, we formulate two types of insecure component integration—unsafe component loading and insecure component usage—and present practical, scalable techniques to detect and analyze them. Our techniques operate directly on soft- ware binaries and do not require source code. On the practical level, we have used them to discover new vulnerabilities in popular, real-world software, and show that insecure component integration is prevalent and can be exploited by attackers to subvert important software and systems. Our research has had substantial practical impact and helped
    [Show full text]
  • NREL Has Learned Over the Past 20 Years About Variouwcommunity-Based Learning Programs
    DOCUMENT RESUME ED 397 476 EA 027 711 TITLE School Improvemént Research Series: Series X, 1995-96. INSTITUTION Northwest Regional Educational Lab., Portland, Oreg. SPONS AGENCY Office of Educational Research and Improvement (ED), Washington, DC. PUB DATE 96 CONTRACT RP91002001 NOTE 103p. AVAILABLE FROMNorthwest Regional Educational Laboratory, 101 S.W. Main Street, Suite 500, Portland, OR 97204. PUB TYPE Collected Works General (020) -- Information Analyses (070) EDRS PRICE MF01/PC05 Plus Postage. DESCRIPTORS Academic Achievement; *Change Strategies; Citizenship Education; Cooperative Education; *Educational Improvement; Elementary Secondary Education; *Excellence in Education; *Experiential Learning; Integrated Services; Learning Experience; Learning Strategies; Organizational Climate; School Size ABSTRACT This packet contains seven research briefs in the Northwest Regional Educational Laboratory's (NWREL's) "School Improvement Research Series" for 1995-96. Topical Synthesis #8, "Community-Based Learning: A Foundation for Meaningful Educational Reform" (Thomas R. Owens and Changhua Wang) summarizes les..ons that NREL has learned over the past 20 years about variouwcommunity-based learning programs. Close-Up #19, "Educating for Citizenship" (Kathleen Cotton), describes issues concerning the content and processes of civic education. Close-Up #20, "School Size, School Climate, and Student Performance" (Kathleen Cotton), reviews research literature that examined the relationships among school size, school climate, and student performance. Snapshot 1/37, "Providing Integrated Services in an Inner-City School" (Joan Shaughnessy), relates how a small innAr-city public elementary school--the Family Academy, New York, New York--designed an approach that successfully integrated social services with academic learning. Snapshot #38, "Integrating Middle School Curriculum around Real-World Issues" (James W. Kushman) describes how Waldo Middle School in Salem, Oregon, integrated middle-school curriculum around real-world issues.
    [Show full text]
  • Computational Propaganda in Russia: the Origins of Digital Misinformation
    Working Paper No. 2017.3 Computational Propaganda in Russia: The Origins of Digital Misinformation Sergey Sanovich, New York University 1 Table of Contents Abstract ............................................................................................................................................................... 3 Introduction.......................................................................................................................................................... 3 Domestic Origins of Russian Foreign Digital Propaganda ......................................................................... 5 Identifying Russian Bots on Twitter .............................................................................................................. 13 Conclusion ......................................................................................................................................................... 15 Author Acknowledgements ............................................................................................................................ 17 About the Author ............................................................................................................................................. 17 References ........................................................................................................................................................ 18 Citation ............................................................................................................................................................
    [Show full text]
  • Lisans Gerektirmeyen Programlar Lisans Gerektirmeyen Programlar
    Lisans Gerektirmeyen Programlar Lisans Gerektirmeyen Programlar GNU Özgür Belgeleme Lisansı.Bu lisansın amacı, bir kullanıcı kılavuzuna, bir ders kitabı veya başka işlevsel ve faydalı bir belgeye, herkesin, etkili bir kullanım hakkıyla, ticari veya gayri-ticari, değiştirerek ya da olduğu gibi, almak ve tekrar dağıtmak özgürlüğü anlamında, serbest kullanım hakkı vermektir.İkincil olarak, bu Lisans, yazar ve yayıncının, başkaları tarafından yapılan değişiklikler sebebiyle sorumlu olduklarını düşünmeden, bir bakıma yaptıkları işten saygınlık kazanmalarını da sağlar 3D Graphics -------------------------- 3Delight Free - http://www.3delight.com/index.htm Anim8or - http://www.anim8or.com/ Blender - http://www.blender3d.org/ Now3D - http://digilander.libero.it/giulios/Eng/homepage.htm OpenFX - http://www.openfx.org POV-Ray - http://www.povray.org/ Terragen - http://www.planetside.co.uk/terragen/ Toxic - http://www.toxicengine.org/ Wings 3D - http://www.wings3d.com/ Anti-spam programs ----------------------------- K9 - http://www.keir.net/k9.html MailWasher- http://www.mailwasher.net/ POPFile - http://popfile.sourceforge.net/ SpamBayes - http://spambayes.sourceforge.net/ SpamPal - http://www.spampal.org/ Anti-Spyware ---------------------------------------- Ad-aware - http://www.lavasoft.de/software/adaware/ Bazooka - http://www.kephyr.com/spywarescanner/index.html Hijackthis - http://http://ctech.link/remove-spyware Microsoft Defender (Beta 2) - http://www.microsoft.com/athome/security/s...re/default.mspx SpyBot Search & Destroy - http://spybot.safer-networking.de/
    [Show full text]
  • Web Browser Free Download for Mobile
    Web browser free download for mobile click here to download Experience a fast, smart and personal Web. Firefox is the independent, people-first browser made by Mozilla, voted the Most Trusted Internet Company for. This is no doubt the fastest browser ever Over 1,, Download Web Explorer rewrite the stock rom of Android Browser and eliminate unnecessary. Opera Mini. Opera Mini is one of the world's most popular web browsers that works on almost any phone or tablet. Discover new content and speed up slow connections with our fast mobile browsers for Android and iOS. Opera is a fast and secure browser. Developed in Europe, used by millions around the world. Now with a built-in ad blocker and free VPN. Outfoxin' the Trackers: Android Private Browsing with Firefox Focus In our everyday quests through the wild untamed country of the web, we need ways to. Mobile phones and tablets will come with a browser, but depending Need a Mobile Web Browser? Price: Free (UC web Download Page). Download your free mobile browser now: Use Dolphin's tabbed browsing, share any web content instantly to your favorite social networks and send between. Firefox for Android, free and safe download. Firefox latest version: Feels like Firefox, just mobile. What's the Best Browser for Web Developers? Read more. If you're looking for am alternative mini web browser for your mobile phone It's available for free on the Opera Mini Download Page or directly. Full PC-style browsing on all types of mobile phones; Web content is never reformatted, repurposed or removed; Loads pages faster than.
    [Show full text]