By: Steve Davis, Vice President of Forensics and Investigations
We live in an era in which information is a valuable commodity. Access to data, ideas, and trade secrets is in high demand, particularly for individuals or companies seeking to profit from this information. One way they gain access to this data is through exfiltration, a type of electronic information theft. While all organizations are at risk for exfiltration, recent surveys indicate that upwards of 70% of ex-employees have knowingly or unknowingly migrated or exfiltrated IP and/or trade secrets when leaving their employ.
What is Exfiltration?
Also known as data extrusion, data exportation, or data theft, exfiltration is the unauthorized breach of a computer, other electronic device, or network. Sensitive information is copied, transferred, or retrieved from a computer or server and saved in another location by someone who was not granted permission to migrate it. The information can later be used to replicate ideas, steal customers or gain unfair business advantages.
Threats of exfiltration come from many sources, including internal company stakeholders, former employees, and competitors. Professional cybercriminals may use targeted attacks to gain access to devices or networks to locate and copy specific data pertaining to:
- Legal files
- Banking documents
- Medical records
- Educational records
- Client lists
- Proprietary information
Exfiltration can be accomplished manually by a person with physical access to a device or remotely by someone using malicious programming that attacks a network through automation. This type of information theft is difficult to detect because it often looks like regular network traffic. In reality, your data is being moved outside of your organization’s control. Unfortunately, this means that the damage is already done before it’s ever discovered.
Guardians Against Exfiltration Services
Purpose Legal offers proactive steps for safeguarding clients’ intellectual property (IP) and trade secrets. Guardians Against Exfiltration Services protect against the unauthorized distribution of your clients’ most valuable assets. This unique approach identifies potential breaches of devices and networks, ensuring the longevity and integrity of proprietary innovations.
Guardians Against Exfiltration Services works to monitor, detect, and counteract data exfiltration, both by individuals within your organization and those outside of it. Our three-point analysis pinpoints the source, the channel, and the intended landing site for your stolen data to preemptively provide protection against IP theft.
The Lifecycle of an Exfiltration Investigation
Our investigators examine a number of elements to identify weaknesses in network systems and to uncover attempted manual data theft by persons inside the organization. Those areas of investigation include:
- Source Analysis
- Conduit Examination
- Landing Area Investigation
- Behavioral Analysis
- Investigative Analysis
- Deleted Data Review
1. Source Analysis
The first step in an exfiltration investigation is to identify the source of the theft. Whether a threat is internal or from outside of the organization, the source influences the path an investigation takes. Investigators can identify potential threats and determine the types of information someone is attempting to steal.
2. Conduit Examination
A conduit is a path by which stolen data or information travels from one location to another. During an exfiltration investigation, investigators track the movement of data across various channels, including USB devices, cloud repositories, email, and more. Understanding how an attack occurred allows an organization to shore up weaknesses in its system, preventing future data breaches.
3. Landing Area Investigation
Once you know the conduits by which information is moving, the next step is to determine where the exfiltrated data is intended to land. This is often a destination accessible to competitors or new business ventures interested in replicating plans or designs.
4. Behavioral Analysis
Understanding the human element involved in data exfiltration is crucial. Behavioral analysis delves into an individual’s online activities, revealing patterns that indicate their risk of future data theft. From online shopping behavior to Internet searches, investigators scrutinize the digital footprints of employees to preemptively identify potential threats.
5. Investigative Analysis
Once your organization has gained an understanding of how data exfiltration occurred and who may be responsible, investigators can take additional steps to help you recognize and prevent future data breaches. To identify future threat points, it’s imperative to perform multiple types of investigative analysis, including:
- USB Connectivity Analysis examines how a USB device interacts with a computer or network to assess if any confidential and/or proprietary corporate data moves outside of the enterprise. Since there may or may not be a way to see what is located on a given removable device without it being in your possession, our investigators perform a correlation analysis to see what information was being accessed or copied in and around the time removable devices were being inserted or used.
- Repository Analysis is a series of operations designed to detect malicious behavior targeting your organization’s information databases. Investigators can examine the contents and activities that have taken place within organizational data archives and recognize possible misconduct.
- Communications Analysis involves examining network traffic and communication patterns. It allows investigators to identify weaknesses in your system and prevent data theft. Using communications analysis, investigators can view how data is moving across systems, including the parties that are communicating about the data, the frequency at which they communicate, and the type of data they are transferring.
6. Deleted Data Review
Recently deleted data can be a source of information theft. Even data believed to have been permanently removed from a device can be mined by people with malicious intent. If organizations are aware that sensitive information is still accessible after it’s been deleted, the deleted data can represent a significant security risk.
Purpose Legal provides a deleted data review service to properly destroy unwanted files. Deleted data review may also uncover signs of information tampering from within your organization, providing the opportunity to shore up weaknesses.
Why Choose Purpose Legal
During an age when cybersecurity risks and exfiltration concerns are around every corner, investing in digital security is essential. Equally important is having a plan of action when employees or contractors with data access leave their employ or complete their contract with your organization.
When you choose Purpose Legal to safeguard your clients’ information, you’re not just hiring a cybersecurity service. You’re partnering with a team that views its role as a guardian of intellectual legacy. Our trained experts dedicate 12-15 hours per system, employing cutting-edge techniques and years of combined digital forensic experience to protect your clients’ innovations and proprietary property.
Contact our team today to learn more about how Purpose Legal will go to work for you.
