The Metadata Minefield: Protecting All Your Sensitive Data

Originally published by Symmetry Systems.

Written by Claude Mandy, Chief Evangelist for Data Security, Symmetry Systems.

When determining the sensitivity of data, it’s easy to focus solely on the content itself. However, the metadata associated with data can potentially expose other just as sensitive information than you might realize. Metadata, often described as “data about data,” serves valuable purposes internally, but it can become a minefield if that metadata is shared externally.

Over the past several years, numerous incidents have surfaced where metadata has caused professional and political embarrassment, even being considered breaches in their own right, when compromised by a cybercriminal. The risks associated with metadata exposure range from minor embarrassments to major security breaches, potentially impacting an organization’s reputation, financial standing, and competitive edge.

#TLDR

Metadata is the hidden information goldmine attached to your data. While useful internally, it can become a serious security risk when shared externally. From revealing confidential business deals to exposing personal information, metadata breaches can lead to reputational damage, financial losses, and legal troubles. Protect your metadata as vigorously as you guard your primary data to avoid falling into this often-overlooked security pitfall. Don’t compromise for the sake of convenience.

What is Metadata?

Think of metadata as a hidden level of extra information that is automatically created and embedded to any data object. It’s akin to the label on a can of soup, which contains structured information about the contents inside. Just as the soup label tells you the type of soup, who made it, and its nutritional value, document metadata provides information about the data object’s contents and history.

Whenever a data object is created, edited, or saved, metadata is added or recorded somewhere. This information often accompanies the data object wherever it goes, whether it’s sent as an email attachment or uploaded to a website, but can also be stored elsewhere such as in logs or data catalogs . The types of metadata can vary, but often include:

• The data object name
• The data object storage location, including hyperlinks
• Security properties such as encryption state, public accessibility and more
• Embedded thumbnails
• Creator names and contact information
• The company or organization’s name
• Data classification tags
• File properties such as last access date, creation date and modification history
• A unique identifier or hash – to cryptographically identify the data object
• Device and software fingerprints identifying what was used to create the date

While this metadata can be incredibly useful for internal purposes, such as version control and collaboration, it can also contain potentially sensitive information. When documents are shared externally, this hidden data may inadvertently disclose confidential details to unauthorized individuals or groups.

The Risks of Metadata In the Wrong Hands

The consequences of metadata ending up in the wrong hands can be severe and far-reaching. Organizations may face:

1. Privacy violations and potential identity theft
2. Reputational damage and loss of customer trust
3. Regulatory fines and legal repercussions
4. Operational disruptions and financial losses
5. Long-term damage to business relationships and market position

The risks compound when files are shared externally with partners, customers, or other third parties. Even if the files themselves are carefully sanitized, the associated metadata could still expose critical details about your organization, its personnel, operations, and intellectual property.

Let’s look at some of the ways metadata can inadvertently leak sensitive data.

File Naming Conventions

The names you give to data objects or file may seem harmless at first, but often they actually divulge sensitive details. Names often contain personal information, project code names, birth dates version numbers, or other identifiable data that not only provide clues about the nature and contents of the files, but are sensitive in themselves even if the files themselves are encrypted or obfuscated.

Illustrative example: A law firm inadvertently reveals sensitive information through their file naming convention. A document named “Merger_BigCorp_SmallCorp_Draft3.docx” is accidentally shared with a third party, exposing confidential information about an upcoming merger between BigCorp and SmallCorp before it’s publicly announced.

Embedded Metadata such as Geolocation and Device Fingerprints

Photos, videos, and other multimedia files often include geolocation metadata pinpointing where the content was created. This could potentially expose sensitive locations like someone’s home or a confidential business site. Many file formats, like Microsoft Office documents and PDFs, also contain embedded metadata that can expose a trail of digital breadcrumbs. This metadata might include details about the document’s author, revision history, comments, tracked changes, and even thumbnails that could reveal sensitive content.

Illustrative example: An insurance firm stores photos from their insured in relation to recent home insurance claims. The insured is a huge Hollywood star. The photos are named “Client_Livingroom1.jpg”. The image’s metadata includes GPS coordinates, revealing the exact location of the insured’s house. The photo is shared with a third party assessor, who uses the metadata to determine and sell the home location of the Hollywood star.

Cloud Storage Location

While cloud storage offers convenience, the metadata gathered automatically by these services can be a double-edged sword. Access logs, synchronization data, collaboration histories, storage locations, public accessibility and encryption details could all potentially reveal sensitive information about your data, its security and how it’s being handled.

Illustrative example: A well respected hospital has deployed Microsoft OneDrive to all employees. During a data security assessment, a third party analyzes the metadata from that environment and pinpoints publicly accessible documents containing hundreds of credit card numbers. The metadata reveals the direct URL with which these data objects could be directly accessed. Shortly after the assessment, a number of these credit cards are involved in fraudulent activity.

Software Supply Chain Disclosure

Metadata can often reveal components of the software supply chain used in the creation of the data objects. This information allows attackers to infer details about the organization’s IT infrastructure, potentially including operating systems, document management practices, and even procurement decisions. Such disclosure can be particularly dangerous if the identified software version has known vulnerabilities. It enables attackers to map out potential weak points in the company’s digital ecosystem without directly interacting with their systems.

Illustrative example: A huge multinational uploads a PDF of its product brochure to its website. The document looks flawless, but the metadata wasn’t scrutinized. A cyber criminal examines the file and discovers it was created by [email protected] using LibreOffice 5.1 with PDF version 1.4. They use this information to identify a specific exploit, craft a malicious document, and use social engineering to trick the employee into opening it. This gives him shell access to the victim’s machine and access to the multinational network.

Activity Logs indicating High Value, Importance and Usage

Logs can reveal a lot of confidential information without including any sensitive data. Patterns in these logs can expose active projects, poorly performing products, and potential values without breaching actual documents. This information enables insights into the high value and important data of an organization based on usage. Understanding who is using what data can violate confidentiality, and can disrupt operations.

Illustrative example: A financial services company uses Amazon S3 to share deal information with corporate development teams at multiple potential acquirers. The financial services access logs are compromised, revealing patterns of file access that indicate which potential acquirers are likely involved in a confidential, high-value transaction. This information is exploited by insider traders.

Mitigating Metadata risks

Understanding your metadata footprint is the first step in navigating this hidden minefield. Start by mapping out what metadata your organization generates and shares externally. This isn’t just about files – consider the metadata being queried directly from cloud services, APIs, and third-party interactions. Once you’ve got a clear picture, understand where this data is going and what the data could be used for. When choosing new products and services – particularly those focused on data, prioritize services that don’t only play lip service to protecting your data, while vacuuming up all your metadata, but keep all data within your environment

Remember, it’s not about eliminating metadata, but managing it wisely. By treating metadata as a valuable asset with its own risk profile, you’ll strike the right balance between leveraging its benefits and safeguarding your organization’s sensitive information.

About the Author

Claude Mandy is the Chief Evangelist for Data Security at Symmetry Systems, where he focuses on innovation and industry engagement while leading efforts to evolve how modern data security is viewed and used in the industry. Prior to Symmetry, he spent 3 years at Gartner as a senior director, analyst covering a variety of topics across security, risk management and privacy, focusing primarily on what are the building blocks of successful programs, including strategy, governance, staffing/talent management and organizational design and communication. He brings firsthand experience of building information security, risk management and privacy advisory programs with global scope. Prior to joining Gartner, Mr. Mandy was the global Chief Information Security Officer at QBE Insurance - one of the world's top 20 general insurance and reinsurance companies with operations in all the key insurance markets, where he was responsible for building and transforming QBE's information security function globally. Prior to QBE, Claude held a number of senior risk and security leadership roles at the Commonwealth Bank of Australia, Australia's leading provider of integrated financial services which is widely recognized for its technology leadership and banking innovation. He also spent five years at KPMG in Namibia and South Africa.