Peer-to-Peer Goes Both Ways

We all know the dangers of peer-to-peer (P2P) networks and their role in distributing malware. Most people who deal with this problem work tirelessly to limit the impact of these potential threat points by (among other things) adding anti-virus, firewalling, watching network flows for P2P traffic, and usually outright banning of P2P applications.

They may, however, be looking the wrong way. The bits and bytes flow in two directions–in and out. Data leakage from a network is just as serious as bringing in malware-laden MP3s, cracked software, or Mov files.

You may be thinking to yourself, “Yeah, but leaking information is for disgruntled employees, or those looking to profit from foreign spies being ‘in the market’ for specific secret data. I don’t employ people who would do that.”

For arguments sake, let’s say that you do in fact employ workers who are of the highest moral character, you’ve firewalled the outside, banned the applications, monitor the network traffic, and updated your anti-virus signatures.

So what happens when one of your employees is out sick–yet a big presentation is still due on Friday? Any chance he or she may take work home to finish when “there just aren’t enough hours in the day”?

The vector does not even need to be company-owned. If an employee is emailed the presentation, or copies it onto a USB device, this is the time that the data is the most vulnerable–it’s out of your control. Most home users do not implement the same security practices that a company does. If that data is moved into a directory reachable by the P2P application, it is reachable by potentially millions of users on the same P2P network. Do you think a file called OurSecretFormula.doc would look enticing?

For those ever-present naysayers, here is a recent example of this occurring.

So the moral of this story is not that this is new or ground breaking–it certainly isn’t. It’s just a reminder to look both ways.