Using steganography in various channels to identify the source of a data leak

In brief

A talk by a DLP vendor: steganography is needed not by the insider but by the security officer — "straw" laid down before the leak, so as to narrow the circle of suspects afterwards. Three ways to find the source: information-system-based, user-session-based, and labels in the file plus encryption. The value — an honest list of unsolved problems and the refusal to sell; but the topic as a method was not covered, and the scheme works before the leak, not for finding the source.

Key points

• Insiders get no further than copy /b: an engine of their own is "not for average minds". They bypass things more simply: Ctrl+F, 5 → "five", and regexes go blind; "a gazillion ways" that not a single DLP will see through without neural nets.
• The security officer needs it in order to "lay down some straw": within the "24 hours to respond, 72 hours", to give the point to dig from.
• Approach No. 1, information-system-based: interception with attributes (who was CC'd, attachments, IP, MAC), the object — the account; integration at the driver level (DCAP) is needed, while the DLP agent is "not very good yet on macOS, and practically useless" in the cloud.
• A cloud document cannot be assembled either with a keylogger or by intercepting HTTPS (each packet carries only the delta: "PL", then "AN") — only via API: Google Workspace, VK, Yandex 360, M365/Graph API, "you can't integrate with everyone out there".
• Approach No. 2, user-session-based: watermarks on all monitors at the driver level against photographing the screen with a smartphone — the username, the machine name, the date, the time show up; at EveryTag a document is marked by shifts in line spacing and indents.
• Four unsolved problems: formats ("audio… what do you do there? Unclear"); a unique copy for every user; the mark dies from an overexposed photo; retyping "letter for letter" — "What do you do? Nothing".
• Demand has grown over two years, but the speaker is not selling "elephants": there will be nothing universal for all channels (a printer needs its own, audio and engineering drawings their own, text a third thing); the only universal things are labels in the metadata plus encryption based on them — ABAC, "reinventing… Microsoft RMS".
• The bottom line: steganography is "just a supplement"; "the best incident is the one that never happened", the insider is to be caught "on takeoff".

Tools, artifacts, technologies

• Used and shown: DLP (not named), DCAP, a DLP agent, a keylogger, HTTPS interception, cloud APIs, VDI, a connection graph, watermarks on monitors (they die from overexposure). Reference points: EveryTag, the watermarks of deepfake generators and their detectors, labels in the metadata, Microsoft RMS, ABAC — in development.
• Criticized: regular expressions; copy /b and Ctrl+F — the insider's arsenal; LLMs — expectations for now; from the Q&A — Canarytokens, the "zero pixel", an IP logger; from the audience — audio watermarks "since the 90s".

Legal and organizational context

Barely came up at all: no articles of law, no agencies, no methodologies — corporate information security, not forensics. The only norm, and with no source: "24 hours to respond, 72 hours to report something to someone"; Federal Law 152-FZ and Roskomnadzor were not mentioned. The framing — "the incident lifeline" and the protected perimeter. The terminology — "leak", "incident", "personal data", "security officer".

Questions from the audience

• An attendee (did not introduce himself) — an addition: audio watermarks "have existed almost since the 90s"; the speaker did not answer.
• His question as well: what is your view of Canarytokens — the zero pixel for tracking whether a document has been opened? The answer: negative, this is "the need for an active action, that is, a risk of exposure"; "that kind of functionality should be something you can switch off".
• There were no more questions: "I see no hands".

The speaker's position

Steganography is not a panacea but a supplement to DLP/DCAP; the problem has been solved by no one, the speaker included. He argues with the belief in a universal labeling mechanism and with the idea that LLMs will sort out DLP bypasses. He admits the limitations himself: the agent is weak on macOS and in the cloud, "our watermarks" do not survive overexposure. The tone — a conversational lecture with self-irony, not a sales pitch.

Quotes

• "…not for average minds, writing your own engine for it and getting further than copy /b…"
• "In the end, formally you have the entire capture, but no complete document to analyze."
• "I didn't come here to sell you some of our elephants…"
• "My personal view: in principle, the best incident is the one that never happened."