Understanding Exfiltration – What you Need to Know

Exfiltration of sensitive data is a key threat to many businesses. Whether this is financial details, personally identifiable information (PII) or trade secrets, stolen data can be hugely valuable to cybercriminals. They may choose to sell this on the dark web or use it as part of a ransomware extortion attempt.

As such, it’s vital that preventing data exfiltration is a key part of any cybersecurity strategy. The right tools ensure that any threats that are able to bypass network perimeters can still be spotted and neutralized before they have a chance to do damage.

Understanding data exfiltration is an essential part of developing a comprehensive cybersecurity platform. Without this, you could be blind to any threats that have bypassed perimeter defenses and are already embedded in your organization. Without visibility into what information is being transferred and where it’s going, you won’t be able to prevent data exfiltration by a malicious actor.

The term exfiltration usually refers to a stealthy exit. In terms of cybersecurity, exfiltration is defined as the theft or unauthorized removal of digital data from a device without the company noticing. This could involve the copying and transfer of information to criminals, but in some cases – especially when undertaken as part of a ransomware attack – original data may be wiped or encrypted. If firms do not have backups to turn to, this can be especially damaging.

The terms data breach and data leak are often used interchangeably, but they refer to very different activities, which need their own forms of protection. In general terms, while data leaks refer to accidental loss of data, such as public disclosures caused by carelessness, data breaches are usually a deliberate act.

This means they can have very different outcomes. Once criminals possess data, there are many opportunities to do damage, such as demanding ransom payments in exchange for deleting data, selling customer PII and financial details to fraudsters, or simply releasing sensitive information to the public to cause disruption.

There are several ways in which people with unauthorized access to systems can seek to exfiltrate data. The most common is for malware to gain access to a network – for example, via a phishing attack, which allows attackers to move within the network looking for the most valuable data, which is then transferred back to their control server.

However, you also have to consider the possibility of an insider threat – the deliberate theft of information by people within the business, who may or may not have legitimate access to it. There are several reasons why this may occur, such as disgruntled employees looking to profit from selling sensitive information, or taking trade secrets with them to a new employer.

In some cases, it can even be done in person. Unsecured physical access to server rooms, or even connected devices that have been left unattended, make easy targets for cybercriminals. This means a holistic security solution that encompasses both digital and physical tools is a must.

The tools used as part of exfiltration malware can be highly sophisticated, and are often designed specifically to avoid detection. It generally comes in a couple of forms – uploads to external services, often used by external actors, and downloads to insecure devices such as a smartphone or USB stick, which may be more common for insider threats.

When hackers are sending traffic out of a business using the internet, common tactics include anonymizing connections to third-party services in order to hide the attackers’ identity, so firms need countermeasures that can spot these techniques.

Detection is amongst the most difficult elements of any anti data exfiltration (ADX) strategy, especially in large organizations. In these cases, huge volumes of data will be moving in and out of the business all the time – to customers, suppliers and the cloud. Therefore, being able to look closely at this mass of data to spot suspicious behavior – finding the signal hidden in the noise – can be difficult unless firms invest in the right tools.

If you receive a ransom demand for stolen data, it’s already too late. Therefore, your threat intelligence systems must be able to proactively seek out suspicious activity and enact data loss prevention measures such as blocking suspicious traffic.

However, there are certain steps you can take to ensure you’re not putting the business at unnecessary risk due to leaked data. For example, there are a range of tools you can use to see if privileged usernames and passwords have been compromised that could give hackers easy access to your most precious data.

Effective monitoring solutions are essential in spotting and preventing data exfiltration. These should be able to monitor every packet of data that leaves your network and compare it to ‘normal’ network traffic patterns in order to identify any anomalies that could be a sign of a data exfiltration attempt.

Factors that should be considered include:

• Frequency and volume of data transfers
• Unknown, unusual or obscured destinations
• Transfers from users with privileged accounts
• Unusual access requests for data
• Traffic outside working hours

Not every transfer that’s out of the ordinary will indicate data exfiltration. Therefore, to reduce false positives, it’s important to use a sophisticated solution that applies behavioral profiling techniques  to build a comprehensive picture of what normal user activity looks like and what is a cause for concern.

One key part of an ADX strategy is endpoint protection. The stolen information will have to leave the network somewhere, so paying close attention to any external touchpoints is the key to success.

This can be tricky in a modern environment where the number of endpoints is increasing all the time. Smartphones, tablets, personally-owned laptops and even Internet of Things devices can all be used as exfiltration points, and these can be hard to keep control of, especially in hybrid and remote working scenarios. 

Therefore, organizations need to have on-device protection that can detect unusual traffic and automatically block data exfiltration attempts. BlackFog’s protection offers a lightweight, unobtrusive solution that sits on the endpoint, using a range of data loss prevention tools to protect information no matter where the device is located.

Learn more about how BlackFog protects enterprises from the threats posed by data exfiltration.