What is Information Leakage?

Information leakage is a term we are hearing more about these days. But what is it, and what does it look like?

There's a useful briefing document Information Leakage available from the Information Security Forum (ISF), that describes the what information leakage is, why it's important and ways to reduce the likelihood of information leakage occurring. It describes information leakage as "an incident where the confidentiality of information has been compromised" but I'd also include privacy breaches within that description. An alternative application development view of information leakage is published by the Web Application Security Consortium (WASC).

We've all heard about lost laptops and misplaced USB memory sticks, but in what other more subtle ways can information leakage occur? Well, certainly by malicious hacking, but also by more ordinary actions too. This week, I was looking for a location to host a meeting, and some of the possible venues had web site enquiry forms to collect my requirements. One of these form submissions appeared to work okay, but shortly afterwards I received a message from their mail server informing me that it had been unable to deliver an email from me to two of the company's email addresses:

I've mentioned previously about using email in business processes in Keep The Emails Coming and Application Data Flows by Email. But what else did this fault lead to? Well it gave away (leaked) two email addresses and an internal document that was attached. In fact, I don't think there was any information that I hadn't added myself in the attachment, but it may be that the two email addresses were not intended to be known publicly.

This seemingly small, and hopefully transient fault, has leaked some information. Whilst it is not major in any way—more like a couple of drips than a flood—you can see how information can be divulged in unexpected ways.

In this example, using an external email address as the "from" or "reply-to" fields within internal business processes may be convenient, but in error situations the sender may be notified, so do this with care. A similar situation might also occur if your own mail server rejects the message as spam, or has an out-of-office auto-responder set up for the recipient email account.