What Is Data Exfiltration?

Data exfiltration is the unauthorised transfer of data out of an environment. It is the objective of most intrusions that are not purely destructive, and it is the event that determines whether an incident becomes a reportable breach.

It is also the stage at which detection is most valuable and most often absent, because the controls organisations invest in are overwhelmingly directed at keeping attackers out rather than keeping data in.

The channels

Ordinary web upload to cloud storage and file sharing services, which is the most common route because those destinations are permitted and encrypted. Email, including to personal accounts. Removable media.

Attacker-controlled infrastructure over standard protocols. Encoding within name resolution queries, which is slow and works where nothing else does. And collaboration platforms, which are trusted, permitted and rarely inspected.

Staging is the detectable precursor

Before data leaves, it is usually collected: files gathered from many locations into one, compressed, frequently encrypted or password-protected to defeat inspection.

That staging activity is more distinctive than the transfer itself. Large archives appearing in temporary directories, compression utilities running on a file server, or a single account reading unusually many documents are all better signals than the outbound connection.

Why volume thresholds disappoint

Detection built on transfer size misses the slow approach — small amounts over weeks — and misses the case where the valuable data is small. A customer database export may be a few megabytes.

It also produces constant false positives, because legitimate large transfers are routine: backups, replication, video, data science workloads. Destination and context matter more than size.

What helps

Egress control, so transfers can only reach approved destinations. Data loss prevention on the channels that matter, which requires knowing what sensitive data looks like.

Controlled name resolution with query logging, which closes the DNS channel. Cloud storage control, permitting corporate tenants and blocking personal ones. And monitoring of access volume at the data layer, which catches collection regardless of how it eventually leaves.

Insiders use different channels

An employee removing data uses email to a personal account, personal cloud storage, removable media, printing, or photographs of a screen. Those are not the channels an external intruder uses.

Which means a programme aimed only at external exfiltration misses the more common case. See insider threat.

The deliberately slow variant

A patient adversary moves small volumes over weeks, at ordinary times of day, to destinations that appear routine. Nothing about any individual transfer is remarkable, and every volume-based threshold is designed to miss it.

What catches it is cumulative rather than instantaneous measurement: how much has this identity moved to this destination over a month, and is that consistent with the role. That requires retaining the data long enough to aggregate, which is the same retention argument that appears everywhere else.

Where to start

Establish whether personal cloud storage and webmail are reachable from your corporate network, and whether name resolution goes through infrastructure you log. Those are the two widest channels.

See blocking the quiet exfiltration path. GuardsArm delivers managed security.