Unauthorised transfer of data out of an organisation, whether by attackers or malicious insiders.
Data exfiltration is the unauthorised removal of data from an organisation. Attackers exfiltrate stolen data to external servers, often as part of ransomware attacks (threatening to publish data) or espionage. Exfiltration methods include email attachments, cloud uploads, USB drives, encrypted tunnels, DNS tunneling, and steganography (hiding data in images). Modern attacks often involve substantial data exfiltration before ransomware deployment. DLP, network monitoring, and cloud access controls help detect and prevent exfiltration.
Why It Matters
The DSC Perspective:
Data exfiltration often precedes ransomware demands—attackers threaten to publish stolen data. DLP and network monitoring can detect exfiltration attempts. Understand what sensitive data you hold and where it's stored.