CAS-003 · Question #847
A company has a DLP system with the following capabilities: Text examination Optical character recognition File type validation Multilingual translation of key words and phrases Blocking of content…
The correct answer is B. Scrambling the confidential information using a proprietary obfuscation scheme before sending E. Leveraging stenography to hide the information within the JPEG files. Proprietary obfuscation renders the data unrecognizable to content inspection engines, and steganography hides the data invisibly within the JPEG pixel structure, both bypassing all DLP inspection layers.
Question
A company has a DLP system with the following capabilities:
Text examination Optical character recognition File type validation Multilingual translation of key words and phrases Blocking of content encrypted with a known cipher Examination of all egress points Despite the existing protections, a malicious insider was able to exfiltrate confidential information. DLP logs show the malicious insider transferred a number of JPEG files to an external host, but each of those files appears as negative for the presence of confidential information. Which of the following are the MOST likely explanations for this issue? (Choose two.)
Options
- ATranslating the confidential information from English into Farsi and then into French to avoid
- BScrambling the confidential information using a proprietary obfuscation scheme before sending
- CChanging the extension of Word files containing confidential information to .jpg and uploading
- DPrinting the documents to TIFF images and attaching the files to outbound email messages.
- ELeveraging stenography to hide the information within the JPEG files
- FPlacing the documents containing sensitive information into an AES-256 encrypted compressed
How the community answered
(45 responses)- A22% (10)
- B60% (27)
- C11% (5)
- D4% (2)
- F2% (1)
Why each option
Proprietary obfuscation renders the data unrecognizable to content inspection engines, and steganography hides the data invisibly within the JPEG pixel structure, both bypassing all DLP inspection layers.
The DLP system includes multilingual translation of keywords and phrases, so translating content through multiple languages would still produce detectable text once processed by the translation engine.
A proprietary obfuscation scheme scrambles the confidential data using a non-standard algorithm that produces output resembling random noise, which cannot be matched against known patterns by the DLP's text examination, OCR, or multilingual translation engines since all of those rely on recognizable content structure.
The DLP system performs file type validation, which detects that a file with a .jpg extension has the internal structure of a Word document and would flag or block the transfer.
TIFF images are still raster image files subject to OCR processing, and the DLP's OCR capability would extract and analyze any readable text contained within the attached TIFF.
Steganography embeds data within the least significant bits or other invisible regions of a JPEG's pixel data without altering the visible image, so file type validation sees a legitimate JPEG, OCR finds no readable text, and the hidden payload passes through all egress inspection points undetected.
The DLP system explicitly blocks content encrypted with a known cipher, and AES-256 is one of the most widely known encryption standards, so an AES-256 encrypted archive would be blocked at the egress point.
Concept tested: DLP evasion via steganography and proprietary obfuscation
Source: https://csrc.nist.gov/publications/detail/sp/800-94/final
Topics
Community Discussion
No community discussion yet for this question.