Data Exfiltration

Technical explanation

Exfiltration may occur through network channels, cloud services, removable media, compromised accounts, malicious insiders, covert protocols, or authorised tools used outside policy. It can be rapid or deliberately low-volume to evade detection. Controls include data classification, least privilege, egress filtering, data loss prevention, behavioural monitoring, encryption, and incident response.

Business relevance

Exfiltration can expose personal data, intellectual property, credentials, regulated information, and commercial strategy, leading to operational disruption, notification duties, financial loss, and reputational damage.

Implementation example

An attacker compromises a SaaS administrator account and exports customer records to external storage. Identity telemetry, unusual-download alerts, and egress controls detect and contain the activity.

Limitations and common misconceptions

Data exfiltration is an outcome, not a single attack technique. Legitimate transfers can look similar, encrypted traffic reduces content visibility, and prevention controls can disrupt normal work if classification and policies are poorly designed.

Topics

Sources