From the course: Threat Modeling: Information Disclosure in Depth

Authorized access

From the course: Threat Modeling: Information Disclosure in Depth

Start my 1-month free trial

Authorized access

“

- [Instructor] Data at rest is data that's being stored somewhere. But don't limit your thinking to drives that are connected to a computer. This can be normal files, databases, swap files, all sorts of things. Any data that's stored, and the most obvious place for data is files. Files obviously have content, and that's the first thing to consider. Files can have content that's hidden to various degrees. Spreadsheets allow us to hide columns, and word processors let us reveal or hide tracked information. You can explore tracking changes in Word in setting it to display no markup. I love this headline from "The Onion." It's clearly a joke, but it highlights a good point. Black highlighter can be removed, and even if it can't, the size of a computerized, precisely applied black bar reveals information about how many characters are hidden. Also don't miss that there's a red squiggle so you can see a word is misspelled. The same applies to discs. Files are not deleted, really, but pointers to them get removed from the file lists in directories. It used to be possible to zero out content, but flash drives apply wear-leveling algorithms to make that hard. Additionally, there's another set of problems where confusion leads to authorization being granted. That problem can be the person granting the access is confused. For example, did you mean to grant access to sub-directories? Did you intend to send that file to me? Or did you not notice which Adam your email program auto completed? You can also get a program to use its access to give you access you're not supposed to have, with Etsy password being the canonical example of what gets exposed when the program doesn't canonicalize file names. These programs are often called confused deputies. And because this course is about information disclosure, I want to just close that a confused deputy can cause lots of other problems.

Contents