{"id":484,"date":"2020-09-21T14:27:40","date_gmt":"2020-09-21T14:27:40","guid":{"rendered":"https:\/\/www.discoveroasis.com\/ediscovery-unredacted\/?p=484"},"modified":"2021-03-24T14:58:50","modified_gmt":"2021-03-24T14:58:50","slug":"how-to-safely-take-in-bad-data","status":"publish","type":"post","link":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/","title":{"rendered":"How to Safely Take In Bad Data"},"content":{"rendered":"\n<h3>What do you do when you need to add compromised data to your network? \u201cAirlock\u201d is our solution.<\/h3>\n\n\n\n<p>There are many parallels to be drawn between\ncomputer viruses like ransomware and biological viruses like COVID-19. For\ninstance, a medical center in Oakland, California, was recently in the news for\ntheir failure to separate COVID-19 patients from their general population. A\nKaiser Health News investigation summarized\nthe situation this way: <\/p>\n\n\n\n<p><em>Dozens of nursing homes and hospitals ignored official guidelines to separate COVID-19 patients from those not infected with the coronavirus, in some places fueling its spread and leaving staff unprepared and infected or, in some cases, dead.<\/em><\/p>\n\n\n\n<p>Although those of us that live in the world of servers and data centers aren\u2019t facing life and death situations like those in hospitals, we do face conceptually similar problems regularly. Recently, for example, Oasis received a hard drive containing about 8 TB of data from a client that was involved in time-sensitive litigation; the data was to be processed for attorney review ASAP even though the data was <em>known to contain malware<\/em>. Malware which had bypassed our client\u2019s security system and wreaked havoc on their network. This type of project has a higher level of associated risk for obvious reasons. <\/p>\n\n\n\n<p>Just as health care providers must check\nincoming patients at the door to stop the spread of a virus throughout a\nhospital, IT managers are expected to stop threats at the firewall before they\ninfect the entire network. So,\nwhat should you do if you have data that you\u2019re afraid of? What is the best way\nto disinfect it? <\/p>\n\n\n\n<p>Our solution:\ncreate an airlock. We\u2019ll run you through what an Airlock is and how to create one\nin order to successfully quarantine and disinfect compromised data; a process\nwe went through with the aforementioned 8 TB to cleanse it and put it back in\nthe hands of our client. <\/p>\n\n\n\n<p><strong>Airlock, A Data Quarantine System<\/strong><\/p>\n\n\n\n<p>Creating an Airlock is the key to effectively\nquarantine your data. To understand \u2018airlock,\u2019 you must first understand \u201cair\ngapped.\u201d&nbsp; <\/p>\n\n\n\n<p>The term \u201cair gapped\u201d means there\nis a physical separation between hardware, and therefore, networks. This type\nof configuration exists to erase access points (entry points vulnerable to\nbeing hacked). To put this into our hospital analogy, think of an airlock like\nan ICU: an entirely separate wing to keep highly contagious and severely ill\npatients in one contained area with no through traffic.&nbsp; <\/p>\n\n\n\n<p>The airlock is a special triage area built on air-gapped hardware, used to examine data before it\u2019s added to the main network. With infected data in an airlock\u2019s isolation, you have the advantage of being able to further examine it and disinfect it with <em>zero risk<\/em> to other data or networks. &nbsp;&nbsp;<\/p>\n\n\n\n<p><strong>How To Build An Airlock:<\/strong><\/p>\n\n\n\n<p><strong><em>Setup<\/em><\/strong><\/p>\n\n\n\n<ul><li>Create an isolated subnet on the\nfirewall.&nbsp; <\/li><li>Configure your subnet to disallow\nall outbound connections.<\/li><li>Connect an isolated physical\nserver to the isolated subnet.<\/li><li>The isolated server accommodates\nphysical connections.<\/li><li>Create a virtual file server on\nthe isolated subnet.<\/li><li>The virtual file server is on the\ninternal subnet to receive the sanitized data.<\/li><li>Configure the servers in the\nisolated subnet with special administrative accounts<ul><li>Internal administrators are denied access so that\npersonnel never use internally valid accounts in the airlock.<\/li><\/ul><ul><li>The airlock groups should be locked down to\nSenior Administrators only.<\/li><\/ul><\/li><\/ul>\n\n\n\n<p><strong>Scanning for Malware<\/strong><\/p>\n\n\n\n<ul><li>Configure all related servers with next-generation antivirus applications like Carbon Black Response, Carbon Black Defense, and CrowdStrike Falcon.<ul><li>These will use AI and machine learning to identify known and unknown threats. <\/li><\/ul><\/li><li>Engage a third-party SOC (Security Operations Center) to monitor your system 24\/7. <ul><li>This can significantly reduce the time it takes to identify and contain a threat (we\u2019re talking seconds vs. months) <\/li><\/ul><\/li><\/ul>\n\n\n\n<p><strong>Workflow<\/strong><\/p>\n\n\n\n<ul><li>Connect data to the physical server.<\/li><li>Copy data from the physical server to the isolated file server and begin thorough scanning.<\/li><li>When scanning is complete, copy data from the isolated file server to the internal file server.<\/li><li>Continually monitor the data from that point forward using your suite of security tools and SOC team (as you would for all client data)<br> <br> <\/li><\/ul>\n\n\n\n<p><strong>Summary<\/strong><\/p>\n\n\n\n<p>Setting up an airlock is the\nsafest and most secure way to deal with infected data. And, once it\u2019s set up,\nyour airlock system is ready to be reused time and time again whenever\npotential malware comes your way. Malware crisis averted. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>What should you do if you have data that you\u2019re afraid of? What is the best way to disinfect it? Build an Airlock. Here&#8217;s how to do it, with no risk to your other data or networks.<\/p>\n","protected":false},"author":2,"featured_media":486,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":""},"categories":[5,4],"tags":[32,7,20,9,47,17],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.11 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to Safely Take In Bad Data | Oasis Blog Security<\/title>\n<meta name=\"description\" content=\"What do you do when you need to add bad data to your network? Build an Airlock. Here&#039;s how to do it so you can safely work with compromised data.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Safely Take In Bad Data | Oasis Blog Security\" \/>\n<meta property=\"og:description\" content=\"What do you do when you need to add bad data to your network? Build an Airlock. Here&#039;s how to do it so you can safely work with compromised data.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/\" \/>\n<meta property=\"og:site_name\" content=\"Oasis Blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-09-21T14:27:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-03-24T14:58:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-content\/uploads\/2020\/09\/airlock.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"576\" \/>\n\t<meta property=\"og:image:height\" content=\"471\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Oasis Discovery\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oasis Discovery\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/\"},\"author\":{\"name\":\"Oasis Discovery\",\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#\/schema\/person\/6ad672109da7d89fea903f4266ca8346\"},\"headline\":\"How to Safely Take In Bad Data\",\"datePublished\":\"2020-09-21T14:27:40+00:00\",\"dateModified\":\"2021-03-24T14:58:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/\"},\"wordCount\":740,\"publisher\":{\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#organization\"},\"keywords\":[\"Development\",\"eDiscovery\",\"IaaS\",\"Legal Technology\",\"SaaS\",\"Security\"],\"articleSection\":[\"eDiscovery\",\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/\",\"url\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/\",\"name\":\"How to Safely Take In Bad Data | Oasis Blog Security\",\"isPartOf\":{\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#website\"},\"datePublished\":\"2020-09-21T14:27:40+00:00\",\"dateModified\":\"2021-03-24T14:58:50+00:00\",\"description\":\"What do you do when you need to add bad data to your network? Build an Airlock. Here's how to do it so you can safely work with compromised data.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Safely Take In Bad Data\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#website\",\"url\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/\",\"name\":\"Oasis Blog\",\"description\":\"eDiscovery, Cloud, and Legal Technology News from Oasis\",\"publisher\":{\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#organization\",\"name\":\"Oasis Discovery\",\"url\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-content\/uploads\/2020\/04\/Oasis_Gradient_Blue_RGB.png\",\"contentUrl\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-content\/uploads\/2020\/04\/Oasis_Gradient_Blue_RGB.png\",\"width\":500,\"height\":205,\"caption\":\"Oasis Discovery\"},\"image\":{\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/oasis-discovery\",\"https:\/\/www.youtube.com\/channel\/UC3abuFo4hTfsGEdGqDzQiGA\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#\/schema\/person\/6ad672109da7d89fea903f4266ca8346\",\"name\":\"Oasis Discovery\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/7fcd9dd8dd99cab0a4fb38f67b48d95a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/7fcd9dd8dd99cab0a4fb38f67b48d95a?s=96&d=mm&r=g\",\"caption\":\"Oasis Discovery\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Safely Take In Bad Data | Oasis Blog Security","description":"What do you do when you need to add bad data to your network? Build an Airlock. Here's how to do it so you can safely work with compromised data.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/","og_locale":"en_US","og_type":"article","og_title":"How to Safely Take In Bad Data | Oasis Blog Security","og_description":"What do you do when you need to add bad data to your network? Build an Airlock. Here's how to do it so you can safely work with compromised data.","og_url":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/","og_site_name":"Oasis Blog","article_published_time":"2020-09-21T14:27:40+00:00","article_modified_time":"2021-03-24T14:58:50+00:00","og_image":[{"width":576,"height":471,"url":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-content\/uploads\/2020\/09\/airlock.jpg","type":"image\/jpeg"}],"author":"Oasis Discovery","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Oasis Discovery","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/#article","isPartOf":{"@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/"},"author":{"name":"Oasis Discovery","@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#\/schema\/person\/6ad672109da7d89fea903f4266ca8346"},"headline":"How to Safely Take In Bad Data","datePublished":"2020-09-21T14:27:40+00:00","dateModified":"2021-03-24T14:58:50+00:00","mainEntityOfPage":{"@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/"},"wordCount":740,"publisher":{"@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#organization"},"keywords":["Development","eDiscovery","IaaS","Legal Technology","SaaS","Security"],"articleSection":["eDiscovery","Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/","url":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/","name":"How to Safely Take In Bad Data | Oasis Blog Security","isPartOf":{"@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#website"},"datePublished":"2020-09-21T14:27:40+00:00","dateModified":"2021-03-24T14:58:50+00:00","description":"What do you do when you need to add bad data to your network? Build an Airlock. Here's how to do it so you can safely work with compromised data.","breadcrumb":{"@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/security\/how-to-safely-take-in-bad-data\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/"},{"@type":"ListItem","position":2,"name":"How to Safely Take In Bad Data"}]},{"@type":"WebSite","@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#website","url":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/","name":"Oasis Blog","description":"eDiscovery, Cloud, and Legal Technology News from Oasis","publisher":{"@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#organization","name":"Oasis Discovery","url":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#\/schema\/logo\/image\/","url":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-content\/uploads\/2020\/04\/Oasis_Gradient_Blue_RGB.png","contentUrl":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-content\/uploads\/2020\/04\/Oasis_Gradient_Blue_RGB.png","width":500,"height":205,"caption":"Oasis Discovery"},"image":{"@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/oasis-discovery","https:\/\/www.youtube.com\/channel\/UC3abuFo4hTfsGEdGqDzQiGA"]},{"@type":"Person","@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#\/schema\/person\/6ad672109da7d89fea903f4266ca8346","name":"Oasis Discovery","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/7fcd9dd8dd99cab0a4fb38f67b48d95a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7fcd9dd8dd99cab0a4fb38f67b48d95a?s=96&d=mm&r=g","caption":"Oasis Discovery"}}]}},"_links":{"self":[{"href":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-json\/wp\/v2\/posts\/484"}],"collection":[{"href":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-json\/wp\/v2\/comments?post=484"}],"version-history":[{"count":6,"href":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-json\/wp\/v2\/posts\/484\/revisions"}],"predecessor-version":[{"id":491,"href":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-json\/wp\/v2\/posts\/484\/revisions\/491"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-json\/wp\/v2\/media\/486"}],"wp:attachment":[{"href":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-json\/wp\/v2\/media?parent=484"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-json\/wp\/v2\/categories?post=484"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.oasisdiscovery.com\/ediscovery-unredacted\/wp-json\/wp\/v2\/tags?post=484"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}