Field Insights: Countermeasures for sneaky cloud data thieves with an appetite for cookies

We regularly do Q&A pieces with Netskope field experts to share their first-hand insights from working with organizations.  Read about a common challenge Netskope Regional Sales Engineer Mike Brockney helps organizations resolve with their cloud storage provider.

Describe a common cloud security challenge organizations face?

Enterprises believe they have all the necessary perimeter controls in place. For example, they have tried to lock as much down as possible to prevent users from accessing personal instances of their cloud storage to prevent the exfiltration of their confidential data.   The only way a user can upload sensitive corporate information or customer data is if they store it in their corporate sanctioned instance of cloud storage. But then they find an easy way to bypass all controls.  Just by using a simple HTTP sniffing tool, they maneuver around these controls unknown to any perimeter tools.

How do attackers leverage HTTP tools?  

HTTP tools allow would be attackers to glean the session ID in the form of a cookie.  They could log into a personal cloud storage account outside the corporate environment, copy the session ID, and then use that same ID inside the corporate environment when accessing a corporate instance for the same storage.   By simply swapping out session IDs or cookies, a potential thief could now upload data from a locked down corporate environment to a personal instance of cloud storage.   The user now can upload sensitive corporate data to a personal cloud storage account.

Will cloud application discovery or API out-of-band access prevent this type of data exfiltration?  

They will not.  To thwart this type of data loss, you would require an inline security solution with active controls.  A system is needed that can:

1. Understand different instances of a cloud storage application. For example, differentiate between a corporate instance vs. a personal instance.
2. Bind the instance ID of a cloud storage app to the session ID for a user, for a particular session.

What’s your recommendation?  

Having the first two steps in place above allows a security solution to prevent users who switch their session cookie from exfiltrating data to a personal cloud storage account.   Netskope has these capabilities in place and can help you implement these controls with policies.  By directing traffic from the end user to Netskope, before the data reaches the cloud storage provider, data can be protected.  Let Netskope help you keep your users out of the cookie jar and exfiltrate your corporate data to personal cloud storage.