Hello and welcome to
another application of the modern
tech framework discussion today
we are looking at our case study on
exfiltration, focusing
on sneaky bits
of data.
So what are some potential
exfiltration methods?
Well, this is just a high level look
at some things to consider here when
we look at data exfiltration.
And so in some cases, data
can be encoded into something like
base64 prior to
sending it out. Protector's may have
a custom manipulation
where they encode data
in an attempt to avoid detection
or raise a flag on
that information.
If it is seen now,
they can also use things like SNH
tunnels to connect out
to a command and control server
so they can then send
that information over an encrypted
channel with the hopes again of not
being detected.
Now, the other thing to consider,
if you use things like Dropbox,
one drive, Google Drive,
drive this drive that drive me
home. Anything that you use
to store data
that maybe has a free trial
gives you 10, 15 gigs free
if those repos can
be accessed from
your network.
And then a threat actor in
theory could use those
drives or those areas to load
the data up and then collect
it from another location.
So controlling these
types of applications is going to
be critical when it comes
to protecting your data sets and
ensuring they're not uploaded
to public repose.
That could then put the information
at risk.
So some things to consider.
What controls are you using today
to help block unwanted data
exfiltration?
What does that look like?
Are you blocking things like Google
Drive, one drive?
Are you blocking FTP connections
out?
Why are you doing anything of that
nature?
Would you know if a threat, actor or
employee was removing data from your
network?
So it's not always about threat
actors, there could be some risk
from within a disgruntled employee,
someone who didn't get the raise.
They were expecting someone who's
put a lot of hard work into a
project and feels that they didn't
get enough recognition
for that. So now they're going to
move it off site to keep it tucked
away for something else
if you don't know those things.
I mean, how are you going to control
your information or protect your
intellectual property?
And what could you change today to
reduce the risk of exfiltration?
Maybe review some firewall rules,
block outbound SSL connections,
block outbound FTP connections,
block connections
to data repos like one drive,
Google Docs, Google Drive,
Dropbox, anything of that nature,
if it's not managed by the business
and it's not within the control of
the business, or if it's not
necessary for day to day operations,
it maybe could be considered,
you know, not necessary and it could
be blocked or prevented
on the network.
So with that in those
considerations, I want to thank you
for your time today, and I look
forward to seeing you again soon.