Blog de Joe Freeman

I ran into a situation recently where I almost leaked some private  data when using a sanitized screenshot. I took a screenshot of an order screen and then marked out all the PII. The programs retain the original image and editing information inside the image so that you can re-edit it later.  This means that anyone else can re-edit unless you protect yourself.  I'm still not sure if I did a transitory upload into some cache before fixing this.  TLDR  Flatten or screenshot any editable PNG files. The latter works for every image. Creating and Using the Image This image started off as a Windows 10 snip  screen capture. I then redacted the private information with black squares.  Later I came back and adjusted the squares to hide data.  I copied the image into a Powerpoint presentation and did a talk.  There was no risk up to this point. My solution I exported the Powerpoint as PNGi mage files.  The image files are flattened images of all ...

We're flooded with data.  Customers and fraudsters have the ability to submit data, purchase services or products, and interact with corporate edge systems.  Every transaction should be wrapped with the following questions. Who are we talking to?  What is the risk if we don't know? Who are we talking about?   What is the risk if we tie it to someone we already know about? What is the risk of poisoning other data? Be skeptical my friend. Video Presentation Presentation Content Speakers notes will be added later

Users potentially leak data every time they send information as part of an email or some other message transport.  Data access controls are rendered useless by data sent as email or other attachments.  Potentially sensitive data is impossible to control or remediate once it is outside the reporting system. Reports with incorrect data live on forever as attachments or saved to local file systems.  The data can never be fixed globally  because no one knows where all the copies are.  This creates data consistency issues and potential regulatory issues We heard this     The new system makes it hard to mail data to my external partners. And our answer was      Yes, it is and you should never have been doing that. Recommendations Admit you have a data problem. Create a policy and train people to stop sending sensitive data as attachments. Recognize that transmitti...