25th of January, at 15h00, Tiago Cruz will give a presentation entitled“The Enemy Within: Covert Data Exfiltration for Fun and Profit”
Location: G4.1
Bio
Tiago Cruz is Associate Professor at the Department of Informatics Engineering of the University of Coimbra (UC), where he obtained his PhD in Computer Science, in 2012. He is a Senior Researcher at the Center for Informatics and Systems of the UC (CISUC), having started his research activity in 2001. His research interests include (but are not restricted to) topics such as management systems for communication infrastructures and services (operator and data center environments), embedded computing, critical infrastructure security, IT security and data privacy, broadband access network device and infrastructure management, 5G, IoT and SDN/NFV, among others. He has been actively involved in several national and international projects within his scope of interests, involving both academic and industrial partners, as well as in pedagogical innovation activities
Abstract
When it comes to protecting confidential and/or sensitive information, organizations have a plethora of recommendations, standards, policies and security controls at their disposal, conceived to deal with a variety of threats. However, most of them share the same fundamental premise: that weaknesses are inline by nature, as a consequence of infrastructure, social and/or technological gaps that can be controlled, mitigated or constrained. Thus, air-gapping (i.e., ensuring that systems have no connectivity means of any sort) is often regarded as a sound strategy to increase security, preserve sensitive data, and safeguard critical information. But then there’s the question: is air-gapping that good?
This talk will discuss how exfiltration can take place in supposedly air-gapped environments, by abusing one specific kind of infrastructure that is often forgotten.