The first step in defending against #date #exfilration is to understand exactly what it is and how it works. We’ve covered everything you need to know about #DataExfiltration and how to prevent it here

Cybersecurity is now the biggest challenge that many businesses face. According to AON, cyberattacks leading to sensitive data breaches and ransomware are now the number one concern for businesses in North America and the UK, ahead of issues such as business interruptions, economic slowdowns and supply chain risks.

The costs of these incidents continue to rise, with figures produced by the Ponemon Institute on behalf of IBM noting that in 2021, the average cost

of a data breach reached $4.24 million – the highest figure in the 17 years it has been conducting this research.

A particular threat that businesses must be aware of is data exfiltration. This can have a wide range of expenses, from reputational damage and lost business, through to ransom payments, class action lawsuits and regulatory penalties. As such, it’s vital that businesses are aware of this threat and are taking the right steps to mitigate it.

 What does data exfiltration mean?

The first step in defending against data exfiltration must be to understand exactly what it is and how it works. It is a term used to describe the movement of data OFF a device, as opposed to infiltration, the movement of data ON to the device.

What is data exfiltration?

Data exfiltration is the unauthorised removal of data from a device, which may be an endpoint such as a PC or smartphone or a database server, for example. This form of data security breach can be among the costliest to a business, as it can be extremely hard to spot. Indeed, in many cases, hackers have been able to transfer materials undetected for months, allowing them to build up a huge repository of sensitive data.

How does data exfiltration occur?

There are a few ways in which data exfiltration works, but they essentially come down to two key attack vectors – outsider attacks and insider threats.

Outside attacks often use techniques such as injecting malware or using phishing attacks to steal credentials and gain access to confidential and encrypted data. Once inside, they can copy data and transfer it back to the attackers at will. In some cases, hackers have been found to exfiltrate data for months or even years before being discovered.

Insider threats, meanwhile, originate from a company’s own employees. This may be inadvertently such as users being careless with their data handling, or more intentional. In these cases, a malicious insider may deliberately copy and remove data, which they can then sell on to criminals or deliver to a competitor, for example. In some cases ransomware gangs are actively recruiting insiders https://www.bleepingcomputer.com/news/security/lockbit-ransomware-recruiting-insiders-to-breach-corporate-networks/ to help them breach corporate networks and execute successful attacks.

Why does data exfiltration occur?

For cybercriminals, exfiltrated data is a highly valuable resource. For instance, sensitive information such as personal customer data or corporate financial details can be used directly to commit fraud or sell on to other criminals. However, other confidential information such as trade secrets or other proprietary information may also be of use as part of corporate or even state-level espionage. In fact, a new service known as Industrial Spy , which promotes itself as a marketplace where businesses can purchase their competitors’ data, has recently been set up by threat actors.

Another growing problem is the risk of cyber extortion, where hackers threaten to publicly release private data online. This is often part of a ransomware attack and can also be highly lucrative, as many firms may feel paying up will be cheaper in the long run than dealing with the repercussions of public data exposure. In 2020, research by RUSI found there were 1,200 so-called double extortion ransomware incidents, with over 60% of these aimed at the US and the UK.

What are the implications of data exfiltration?

Falling victim to a data exfiltration incident can have numerous consequences, both financially and reputationally.

Where is the majority of exfiltrated data going?

Hackers are constantly becoming more organised, with criminal gangs increasingly recognising the value of stolen data, both as a resource they can use directly for activities such as ransomware extortion and to sell on easy profit.

BlackFog’s own research indicates that almost a fifth of exfiltrated data (19 percent) ends up in Russia. The dark web is another popular destination for stolen data, where it can be freely shared and traded. In 2022, for example, confidential data on unreleased iMac products were briefly published online by hacking group REvil after Apple refused to pay a $50 million ransomware demand.

Can exfiltrated data hurt your business?

Stolen data can be harmful to a business in a number of ways. Primarily, it can lead to unhappy customers and lost business, as well as the attention of regulators. With tough legislation threatening heavy fines for businesses that fail to protect sensitive data – up to $20 million or four percent of global revenue under GDPR, for example – the financial cost can be high.

Firms that hold extremely sensitive proprietary data or trade secrets could also lose any competitive advantage they have in the market by giving away designs or future development plans to rivals.

All this is before you consider the reputational damage that a data privacy failure can lead to. With consumers more sensitive than ever to misuse of personal information, they will rarely be quick to forgive a company that has proven unable to take care of their data. For instance, McKinsey notes that 87 percent of people will not deal with a firm if they have concerns about its security practices, while 71 percent said they would stop doing business with a company that gave away sensitive data.

What are the long-term costs of data exfiltration?

In the longer term, companies that have fallen victim to data exfiltration can find themselves facing a range of costs. In addition to regulatory penalties, the threat of class-action lawsuits from affected customers can be high.

As well as direct compensation, preventative measures such as credit monitoring services for any users who had financial details stolen can be a major expense. Elsewhere, the reputational damage such incidents can inflict is also huge and is something smaller companies may never recover from. Indeed, it’s claimed that as many as  60 percent of small businesses close within six months of a data breach.

How to prevent data exfiltration

The best defence against data theft is to block it before it happens. Once data has been extracted from a network, the damage is already done, so mitigation and incident response plans can only have a limited impact. You therefore need an anti-data exfiltration, or ADX, solution that stops your business from falling victim in the first place.

How can data exfiltration be prevented?

A key part of any ADX strategy is to monitor all traffic that is leaving the business’ network. Many traditional cybersecurity solutions focus their efforts on protecting the network perimeter against incoming threats.

While this remains an important layer in your cybersecurity defence strategy, relying solely on perimeter defence tactics will leave you  vulnerable should something slip through the net – which, given the prevalence of risks such as zero-day threats, is likely to happen to every business sooner or later.

Therefore, you need to go beyond standard cybersecurity techniques, including data loss prevention (DLP) tools, and look for solutions designed specifically to stop attackers from exfiltrating unauthorised data. This helps you take control of how information flows through your network and ensure that when it is transferred beyond your borders, it is fully authorised and secured.

How can you protect from data loss by negligent, compromised and malicious users?

People who are careless with their credentials – either through weak protections or sharing of details – are among the main causes of data exfiltration. In fact, the Ponemon Institute claims this is the most common root cause of attacks, accounting for 20 percent of all breaches in 2021.

Putting controls in place to prevent reckless behaviour such as password sharing or accessing data via unsecured devices and network connections is a must. However, to be effective, you need to go further to also counter any malicious actor within your business who may be looking to steal data.

To do this, strong ADX solutions must include effective monitoring tools that can keep a close watch on data leaving the network. Using behavioural profiling techniques, suspicious activities – such as users attempting to access resources they do not have permission for or transferring files in an usual way – will be blocked, ensuring that unauthorized data doesn’t leave the network.

The importance of endpoint protection for data exfiltration prevention

Focusing on your endpoint security is another essential part of preventing a data exfiltration attack, and this is something that’s particularly important in the new era of remote and hybrid working, where more business activities take place on personally owned and mobile devices that can often be overlooked by a traditional DLP solution.

For instance, in 2020 – when remote working became the norm for many people – ransomware attacks spiked by 150 percent compared with the previous year. This is no coincidence, as many attackers looked to take advantage of less direct oversight. As these trends are here to stay for many enterprises, on-device security solutions ensure that your threat detection tools extend to every part of your network, no matter where they are or who they belong to.

 

How does BlackFog prevent data exfiltration?

Unlike many other data protection tools, BlackFog uses a layered approach that can identify in real-time any data exfiltration attempts and shut them down before they have a chance to succeed. Our ADX technology provides full on-device protection by blocking outbound data transfer activities to disrupt cyberattacks and protect sensitive data.

With a complete endpoint protection platform to guard against data loss, BlackFog’s unique ADX solution helps block any possible avenue for attackers to conduct a data exfiltration attempt, whether this originates from a hacking attempt, phishing attacks or an insider threat.

Browse our range of products to find out more about how BlackFog ADX can help keep your business safe from the latest threats posed by cybercriminals.

 

BlackFog is proudly distributed by Cloudshop by Mustek, Mustek’s Cloud and Software division.

To learn more or to transact contact: cloudsales@mustek.co.za