Infringement
Disruption of Business Operations
Excessive Personal Use
Exfiltration via Email
Exfiltration via Media Capture
Exfiltration via Messaging Applications
Exfiltration via Other Network Medium
Exfiltration via Physical Medium
- Exfiltration via Bring Your Own Device (BYOD)
- Exfiltration via Disk Media
- Exfiltration via Floppy Disk
- Exfiltration via New Internal Drive
- Exfiltration via Physical Access to System Drive
- Exfiltration via Physical Documents
- Exfiltration via Target Disk Mode
- Exfiltration via USB Mass Storage Device
- Exfiltration via USB to Mobile Device
- Exfiltration via USB to USB Data Transfer
Exfiltration via Web Service
Inappropriate Web Browsing
Installing Unapproved Software
Misappropriation of Funds
Non-Corporate Device
Providing Access to a Unauthorized Third Party
Public Statements Resulting in Brand Damage
Sharing on AI Chatbot Platforms
Theft
Unauthorized Changes to IT Systems
Unauthorized Printing of Documents
Unauthorized VPN Client
Unlawfully Accessing Copyrighted Material
- ID: IF008.007
- Created: 31st May 2024
- Updated: 14th June 2024
- Platforms: Windows, Linux, MacOS
- Contributor: The ITM Team
Gaming
A subject accesses or participates in web-based online gaming from a corporate device, contravening internal policies on acceptable use of company equipment.
Prevention
ID | Name | Description |
---|---|---|
PV021 | DNS Filtering | Domain Name System (DNS) filtering allows the blocking of domain resolution for specific domains or automatically categorized classes of domains (depending on the functionality of the software or appliance being used). DNS filtering prevents users from accessing blocked domains, regardless of the IP address the domains resolve to.
Examples of automatically categorized classes of domains are ‘gambling’ or ‘social networking’ domains. Automatic categorizations of domains are typically conducted by the software or appliance being used, whereas specific domains can be blocked manually. Most DNS filtering software or appliances will provide the ability to use Regular Expressions (RegEx) to (for example) also filter all subdomains on a specified domain. DNS filtering can be applied on an individual host, such as with the |
PV003 | Enforce an Acceptable Use Policy | An Acceptable Use Policy (AUP) is a set of rules outlining acceptable and unacceptable uses of an organization's computer systems and network resources. It acts as a deterrent to prevent employees from conducting illegitimate activities by clearly defining expectations, reinforcing legal and ethical standards, establishing accountability, specifying consequences for violations, and promoting education and awareness about security risks. |
PV006 | Install a Web Proxy Solution | A web proxy can allow for specific web resources to be blocked, preventing clients from successfully connecting to them. |
Detection
ID | Name | Description |
---|---|---|
DT059 | Chrome Browser Bookmarks | Google's Chrome browser stores the history of accessed websites and files downloaded.
On Windows, this information is stored in the following location: |
DT057 | Chrome Browser Cookies | Google's Chrome browser stores cookies that can reveal valuable insights into user behavior, including login details, session durations, and frequently visited sites.
On Windows, this information is stored in the following location:
This database file can be opened in software such as DB Browser For SQLite. The ‘cookies' table is of interest to understand recent activity within Chrome. |
DT060 | Chrome Browser Extensions | Google's Chrome browser stores details about any browser extensions that are installed, providing the user with additional functionality.
On Windows, this information is stored in the following location: |
DT019 | Chrome Browser History | Google's Chrome browser stores the history of accessed websites and files downloaded.
On Windows, this information is stored in the following location:
On macOS:
On Linux:
Where This database file can be opened in software such as DB Browser For SQLite. The ‘downloads’ and ‘urls’ tables are of immediate interest to understand recent activity within Chrome. |
DT058 | Chrome Browser Login Data | Google's Chrome browser stores some login data of accessed websites, that can provide the URLs and usernames used for authentication.
On Windows, this information is stored in the following location:
This file is a database file and can be opened in software such as DB Browser For SQLite. The ‘logins’ and ‘stats’ tables are of immediate interest to understand saved login data.
The passwords are not visible as they are encrypted. However, the encryption key is stored locally and can be used to decrypt saved passwords. The key is stored in the file |
DT018 | Edge Browser History | Microsoft's Edge browser stores the history of accessed websites and files downloaded.
On Windows, this information is stored in the following location:
On macOS:
On Linux:
Where This database file can be opened in software such as DB Browser For SQLite. The ‘downloads’ and ‘urls’ tables are of immediate interest to understand recent activity within Chrome. |
DT017 | Firefox Browser History | Mozilla's Firefox browser stores the history of accessed websites.
On Windows, this information is stored in the following location:
On macOS:
On Linux:
In this location two database files are relevant, These database files can be opened in software such as DB Browser For SQLite. |
DT039 | Web Proxy Logs | Depending on the solution used, web proxies can provide a wealth of information about web-based activity. This can include the IP address of the system making the web request, the URL requested, the response code, and timestamps. An organization must perform SSL/TLS interception to receive the most complete information about these connections. |