{"id":7004,"date":"2016-05-27T14:29:26","date_gmt":"2016-05-27T14:29:26","guid":{"rendered":"http:\/\/digitalassetmanagementnews.org\/?p=7004"},"modified":"2016-05-27T23:03:04","modified_gmt":"2016-05-27T23:03:04","slug":"does-your-dam-leak-data","status":"publish","type":"post","link":"https:\/\/digitalassetmanagementnews.org\/dam-education\/does-your-dam-leak-data\/","title":{"rendered":"Does Your DAM Leak Data?"},"content":{"rendered":"

Recently, I have had cause to go through some prospective DAM solutions that clients have expressed an interest in and do some preliminary exercises with\u00a0a view to shortlisting a few. \u00a0One of the requirements fairly high up on the list was security of their assets. \u00a0The client in question said they had\u00a0an interest in a Cloud DAM (for various operational reasons) but their concern was with how secure they were.<\/p>\n

I have a basic working knowledge of web application security best practices which (while\u00a0not exactly exhaustive) is usually sufficient to top-slice away anything which doesn’t pass a few simple\u00a0tests. \u00a0In the past, I have observed that some legacy DAM applications had some fairly serious security issues<\/a>. \u00a0Most of these were early-stage web solutions\u00a0where the developers implemented them\u00a0that way because they probably didn’t know any better and general levels of awareness about web application\u00a0security\u00a0issues around a decade or so were not as good as they are now.<\/p>\n

In 2016, however, most modern enterprise software tends to have some kind of browser UI and anyone who works in this type of field really has to have a level of understanding that covers the rudimentary issues\u00a0and how they\u00a0relate specifically to the class\u00a0of system they work on. \u00a0There are numerous examples, but one which is key to Digital Asset Management is the\u00a0presence of an asset\/user security model which validates each request for an asset by a given user and rejects any where the individual\u00a0lacks the requisite permissions. \u00a0This is fundamental to the security of DAM solutions and all multi-user DAM systems need to have implemented a model like this\u00a0to meet the minimum\u00a0criteria to be\u00a0considered secure.<\/p>\n

One product of those I was asked to look\u00a0did not have this. \u00a0The user interface was very slick, had all the ‘glide and slide’ animations etc but no\u00a0security model had been\u00a0implemented. \u00a0There was a user ID and password, but they were only needed to get into the system, if you knew the location of the assets, you could get to them directly without logging in. \u00a0To make matters worse, the asset IDs were numeric. \u00a0Of itself, this wasn’t an issue, but it meant it was possible to flip through the entire catalogue by just incrementing\u00a0the ID in the URL via the address bar of a\u00a0browser. \u00a0This is the security equivalent of locking the front door to your house and leaving \u00a0the windows and garage door wide open. \u00a0Testing this is fairly\u00a0easy for anyone to do without special tools etc, you can right-click (or control-click if you are a mac user) and copy the download link and then paste it into a different model\u00a0of browser to the one you use to access the DAM. \u00a0So if you are on Chrome, then you paste the link into Firefox, Internet Explorer etc. \u00a0If you can still download a file\u00a0without being given a user ID and password prompt then\u00a0your DAM is not secure.<\/p>\n

There are some mitigating factors and additional considerations with this test that it would be remiss not to mention. \u00a0A fair number of DAM vendors who use Cloud delivery methods now store digital asset binary essences (i.e. files)\u00a0on a cloud storage service like Amazon S3 or Google Cloud etc. \u00a0I have described how these work in the past<\/a>, the DAM system acts like a broker or intermediary to point you to the asset file\u00a0when you request it. \u00a0I am not fully familiar with mechanics of these delivery systems, but one method which is popular is to provide a temporary\u00a0link which will work for about 30 minutes and then a new URL has to be generated (which you can’t do if you’re not logged in). \u00a0This isn’t great if you have higher than average security requirements, but for standard materials (i.e. nothing sensitive\u00a0where a brief ‘window’ of open access is acceptable) then it is probably a fair trade off. \u00a0The technology for this is implemented by the cloud provider and they tend to use hard-to-guess identifiers composed of hexadecimal strings (or numbers and letters between ‘a’ and ‘f’ for non-technical readers) that have the appearance of being randomly generated. \u00a0As such, if you’ve just found your current DAM system of choice looks like it will\u00a0leak\u00a0your data\u00a0to anyone in the world, leave it an hour or two and then re-test prior\u00a0to\u00a0interrupting the start of\u00a0your vendor account manager’s\u00a0bank holiday weekend with a phone call or irate email about security practices (I’m sure everyone loves to get those kind of emails on a Friday afternoon).<\/p>\n

Before the vendors reading this article breathe a sigh of relief, however, there are a few more twists to this plot. \u00a0As well as checking the asset binary essence itself, nearly all DAM systems worthy of the name<\/a>\u00a0also produce proxies, i.e. previews, thumbnails and other media for display purposes to help users decide if an asset is suitable before they download it. \u00a0In a few cases, especially where larger previews \u00a0are generated and certainly for videos (where higher quality protocols\u00a0like H.264 tend to be the standard now) these are almost as good as the original asset in terms of legibility. \u00a0If the material is sensitive (e.g. previews of pages from documents etc) they could be sufficient for anyone who wanted to collect information to use for nefarious purposes at a later date.<\/p>\n

In\u00a0a further\u00a0three of the applications I tested, while the asset files were secured with transient\u00a0URLs, the previews were all persistently accessible without being logged in when tested (and still are as of today). \u00a0Granted, these weren’t easily guessable, but they did all use a form of identification that related to the asset ID itself. \u00a0These type of identifiers can often\u00a0get included on metadata exports and other outputs\u00a0which could be gleaned by someone who is determined enough. \u00a0To use my earlier metaphor, this is a kind of ‘key under the plant pot’ form of security – you have to guess the right one but a determined burglar probably will be motivated enough to try and do that.<\/p>\n

I suspect these previews are not secured because they need to get used outside the DAM where the\u00a0security isn’t enabled, but they do represent a potential risk and if you have higher than average security requirements (as my client did) then they are probably not a risk\u00a0worth taking. \u00a0There are various alternatives including a hybrid of Cloud delivery and some more conventional methods where previews are not held\u00a0on third party storage. \u00a0Another possibility is using different security models with some that have\u00a0stricter rules than others for more sensitive assets. \u00a0These are all\u00a0fairly technical in nature, however and outside the scope of this piece. \u00a0If this issue is important to you, it would be well worth having a look at how this is handled now and discussing options to tighten things up a bit more with your DAM vendor (if your system of choice currently exhibits these issues).<\/p>\n

The final cloud security story I have about leaking data relates to an\u00a0author whose book I bought about a year ago (unrelated to the DAM field, incidentally). \u00a0I searched for some information about this person\u00a0via a search engine and found links to some\u00a0files from his website that were stored on Amazon S3, in particular, one which was an index of every file he\u00a0had uploaded – not just relating to his book but all kinds of other stuff too. \u00a0Accessing each of these was as simple as just copying and pasting the filenames into the browser. \u00a0The individual in question had uploaded some\u00a0highly personal data which I am 100% certain he\u00a0would not want complete strangers\u00a0to be able to view. \u00a0Since you have to explicitly change settings to do this\u00a0(because it is obviously quite risky and Amazon want to prevent people doing it by accident) I would guess this was an attempt to open up some files for other people to get access to which went wrong and instead he had revealed everything. \u00a0I emailed him and he thanked me and said he would get it looked into, that was about a year ago. \u00a0I can still gain access to this data today.<\/p>\n

This is clearly\u00a0amateur use of cloud storage facilities and a point that should get verified if you are using a commercial DAM, however\u00a0(speaking from personal experience as having been one in the past) engineers and developers do frequently make basic mistakes for a variety of reasons and it should be part of the service delivery process to make sure that more than one person checks all these details and ensures that nothing get left open to the world.<\/p>\n

I will make it plain, this is not just about Cloud DAM security. \u00a0The fact these examples are\u00a0on a public network makes the\u00a0issues more visible but I know they definitely happen with\u00a0internally\u00a0hosted DAMs too (in some cases they are worse because there is less scrutiny of them). \u00a0Just because it’s inside a corporate network doesn’t necessarily mean the consequences will not be as bad – especially if disgruntled ex-employees find they can still get their hands on\u00a0materials which you don’t want them to.<\/p>\n

If you have very high security requirements then as a general rule, DAM solutions might not always be the first choice as a class of products to use for this purpose. \u00a0With that said, it’s almost inevitable that sensitive assets will get uploaded to DAM systems either accidentally or because of a lack of a suitable alternative. \u00a0With that in mind, these\u00a0are\u00a0risk factors that should feature in every DAM initiative project manager’s risk analysis along with reasonably detailed and well-rehearsed plans to\u00a0mitigate them.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Recently, I have had cause to go through some prospective DAM solutions that clients have expressed an interest in and do some preliminary exercises with a […]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[239],"tags":[],"class_list":["post-7004","post","type-post","status-publish","format-standard","hentry","category-dam-education"],"_links":{"self":[{"href":"https:\/\/digitalassetmanagementnews.org\/wp-json\/wp\/v2\/posts\/7004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/digitalassetmanagementnews.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/digitalassetmanagementnews.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/digitalassetmanagementnews.org\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/digitalassetmanagementnews.org\/wp-json\/wp\/v2\/comments?post=7004"}],"version-history":[{"count":8,"href":"https:\/\/digitalassetmanagementnews.org\/wp-json\/wp\/v2\/posts\/7004\/revisions"}],"predecessor-version":[{"id":7012,"href":"https:\/\/digitalassetmanagementnews.org\/wp-json\/wp\/v2\/posts\/7004\/revisions\/7012"}],"wp:attachment":[{"href":"https:\/\/digitalassetmanagementnews.org\/wp-json\/wp\/v2\/media?parent=7004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/digitalassetmanagementnews.org\/wp-json\/wp\/v2\/categories?post=7004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/digitalassetmanagementnews.org\/wp-json\/wp\/v2\/tags?post=7004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}