System and method for detecting data extrusion in software applications
Comprehensive techniques identify data leaks in software applications using Asset Flow Analysis (AFA) to determine whether critical data leaves a system through an exit point such that the data is no longer protected by mechanisms of the system. A novel data extrusion mechanism makes use of a relevant subset of all the possible data paths detected by AFA using a knowledge base of critical business functions and critical database content. The system checks if any code performs read access to critical business data and subsequently transfers this data beyond the control limits of the target system. The knowledge base can be extended by configuring which database content is to be regarded as critical in any given organization. The approach is particularly valuable in protecting systems that manipulate, distribute, or store sensitive information associated with financial, business, or personal data, including SAP® ABAP™ software applications.
1. A method of detecting database extrusion in a software application that provides a knowledge base of critical business functions and critical database content, comprising the steps of:
receiving code adapted for execution on a target computer system having predefined protection limits;
configuring at least a portion of the database content to be regarded as critical;
performing a computerized data flow analysis on the code to determine the paths that will be taken by the source code during execution, the paths including data transfers between read accesses to critical data in the database and data exit points outside the database;
performing a computerized data extrusion analysis to determine if any of the paths identified by the data flow analysis are capable of actually transferring the critical data to the exit points and beyond the protection limits of the target system; and
if such source code exists, reporting the potential data extrusion leak as a security violation.
2. The method claim 1 , wherein the analyses are static analyses performed on the code without actually executing the code.
3. The method claim 1 , including the step of providing a predefined rule-base to identify relevant data exit points associated with commands and API's that transfer the data they receive.
4. The method claim 1 , including the step of providing a predefined rule-base to identify critical data associated with a given organization.
5. The method claim 1 , wherein the exit points are identified even if the destination or protocol is encrypted or scrambled.
6. The method claim 1 , including the step of identifying read access to the critical data without displaying or logging the actual data itself.
7. The method claim 1 , wherein the step of reporting includes the generation of a human-readable or machine-readable report including risk-values for all identified issues.
8. The method claim 1 , wherein the critical data includes one or more of the following:
credit or debit card numbers,
financial data,
business data,
medical/pharmaceutical data,
military information, or
personal data.
9. The method claim 1 , wherein:
the code includes meta information and computer system configuration settings associated with a particular software application;
the code is transformed into an interchangeable format including aggregated source code, parameters, attributes, comments, code meta information and system/meta information; and
the interchangeable format is parsed into an execution model to perform the analyses.
10. The method claim 9 , wherein the source code is modified to include additional metadata about the code itself and the target system.
11. The method of claim 9 , wherein the code, meta information and computer system configuration settings are received from a database.
12. The method of claim 9 , wherein the step of transforming the code is triggered from within a computer system or through a remote function call.
13. The method of claim 9 , wherein the execution model contains authorization, control flow, and data flow information.
14. The method claim 1 , wherein the critical data includes one or more of the following:
credit or debit card numbers,
financial data,
business data,
medical/pharmaceutical data,
military information, or
personal data.
15. The method claim 1 , wherein the computerized data extrusion analysis is performed by analyzing all data paths from critical data to a command or an API function operative to transfer this data beyond the control of the database system.
16. The method claim 1 , wherein the command or API function comprises one or more of the following:
data downloads to a database client,
write-access to a clipboard,
write-access to files,
pop-up screens,
outgoing emails,
outgoing FTP connections,
outgoing HTTP traffic,
HTML outputs,
system messages,
spooler, and
RFC modules.