Stay Out of the Kitchen: A DLP Security Bake-Off
summary
Hands-on testing of Trend Micro, Websense/Triton, Sophos, OpenDLP and others shows real attack paths: 30+ XSS findings in management consoles, CSRF that lets an attacker change or delete policies, and pickle deserialization RCE in Websense policies that becomes distributed arbitrary code execution when pushed to endpoints. Agents and crawlers run as agents running as root or LocalSystem, many appliances ship un-hardened, some traffic uses plain Java-serialized objects, and one vendor (Sophos) shows far fewer basic flaws.
AI-written summary · about
chapters (12)
- 0:00Introduction and agenda
- 1:56Understanding DLP
- 3:47Motivation for the research
- 7:02Workflow and implementation
- 11:53Products evaluated
- 13:32Architectural components
- 21:33Testing methodology
- 25:00General security findings
- 27:35Product-specific vulnerabilities
- 37:15Websense RCE findings
- 40:58DLP bypasses and conclusion
- 45:02Q&A session
related talks
54mThe Kitchen's Finally Burned Down: DLP Security Bakeoff
50mStranger Danger: Your Java Attack Surface Just Got Bigger
44mData Splicing Attacks: Breaking Enterprise...
52mattack-driven defense
01h 00mDefense-in-depth engineering
26mStranger Danger: Your Attack Surface Just Got Bigger
46mThe 5 Most Dangerous New Attack Techniques and How to Counter Them
28mSecuring LLMs: Insights into OWASP top 10