Purpose Legal
We are living in an age where information is a valuable resource. Data, ideas, and business secrets are highly sought after, especially by individuals or businesses looking to profit from them. Exfiltration is a form of electronic information theft that allows them to gain access to the data. While all organizations are at risk for exfiltration, recent surveys indicate that upwards of 70% of ex-employees have knowingly or unknowingly migrated or exfiltrated IP and/or trade secrets when leaving their employ.
What is Exfiltration?
Also known as data extrusion, data exportation, or data theft, exfiltration is the unauthorized breach of a computer, other electronic device, or network. Someone who has not been given permission to migrate sensitive information copies, transfers, or retrieves it from a computer, server, or other electronic device and saves it in another location. The information can later be used to replicate ideas, steal customers or gain unfair business advantages.
Threats of exfiltration come from many sources, including internal company stakeholders, former employees, and competitors. Professional cybercriminals may use targeted attacks to gain access to devices or networks to locate and copy specific data pertaining to:
- Legal files
- Banking documents
- Medical records
- Educational records
- Client lists
- Proprietary information
Exfiltration can be accomplished manually by a person with physical access to a device or remotely by someone using malicious programming that attacks a network through automation. This type of data theft is difficult for people to detect, as it looks like normal network traffic. Your data is actually being moved out of your organization’s hands. Unfortunately, this means that the damage is already done before it’s ever discovered.
Guardians Against Exfiltration Services
Purpose Legal offers proactive steps for safeguarding clients’ intellectual property (IP) and trade secrets. Guardians Against Exfiltration Services prevent the unauthorized distribution and use of your clients’ most important assets. This unique approach identifies potential breaches of devices and networks, ensuring the longevity and integrity of proprietary innovations.
Guardians Against Exfiltration Services works to monitor, detect, and counteract data exfiltration, both by individuals within your organization and those outside of it. Our three-point analysis pinpoints the source, the channel, and the intended landing site for your stolen data to preemptively provide protection against IP theft.
The Lifecycle of an Exfiltration Investigation
Our investigators examine a number of elements to identify weaknesses in network systems and to uncover attempted manual data theft by persons inside the organization. Those areas of investigation include:
- Source Analysis
- Conduit Examination
- Landing Area Investigation
- Behavioral Analysis
- Investigative Analysis
- Deleted Data Review
1. Source Analysis
Identifying the source of theft is the first step in any exfiltration investigation. The source of a threat can influence the direction an investigation takes, whether it is from within or outside the organization. Investigators can identify threats and determine what information someone is trying to steal.
2. Conduit Examining
A channel is a way that stolen data or information can travel from one place to another. During an investigation into data exfiltration, investigators track data movement across multiple channels, such as USB devices, cloud repositories and email. Understanding how an attack took place allows an organization strengthen its system and prevent future data breaches.
3. Landing Area Investigation
Once you know the conduits by which information is moving, the next step is to determine where the exfiltrated data is intended to land. This is often a location that competitors or new businesses can access to copy plans or designs.
4. Behavioral Analysis
Understanding the human element involved in data exfiltration is crucial. Behavioral analysis examines an individual’s online activity to reveal patterns that may indicate future data theft. Investigators examine the digital footprints left by employees, from online shopping to Internet searches to identify potential threats.
5. Investigative Analysis
Once you have a better understanding of the data exfiltration and who is responsible, investigators will be able to take additional steps in order to prevent future data breaches. To identify future threat points, it’s imperative to perform multiple types of investigative analysis, including:
- USB Connectivity Analysis examines how a USB device interacts with a computer or network to assess if any confidential and/or proprietary corporate data moves outside of the enterprise. Since there may or may not be a way to see what is located on a given removable device without it being in your possession, our investigators perform a correlation analysis to see what information was being accessed or copied in and around the time removable devices were being inserted or used.
- Repository Analysis is a series of operations designed to detect malicious behavior targeting your organization’s information databases. Investigators can examine the contents and activities that have taken place within organizational data archives and recognize possible misconduct.
- Communications Analysis involves examining network traffic and communication patterns. It allows investigators identify weaknesses in the system and prevent data loss. Using communications analysis, investigators can view how data is moving across systems, including the parties that are communicating about the data, the frequency at which they communicate, and the type of data they are transferring.
6. Deleted Data Review
Recently deleted data can be a source of information theft. Even data that is believed to be permanently removed from a computer can be accessed by malicious people. Purpose Legal offers a deleted data service to help you properly delete unwanted files. Deleted data review may also uncover signs of information tampering from within your organization, providing the opportunity to shore up weaknesses.
During an age when cybersecurity risks and exfiltration concerns are around every corner, investing in digital security is essential. Equally important is having a plan of action when employees or contractors with data access leave their employ or complete their contract with your organization.
