Ravindra BagaleCourses & study guides मराठी Track your progress

39. Malware Threats

39.10 Detecting Data Theft (DLP)

By Last updated:

Example first. In the 2017 Equifax breach, attackers quietly took the personal data of about 147 million people over many weeks. One reason it went unseen so long: a device that should have inspected outgoing traffic had an expired certificate, so nobody was watching the data leave. Spotting data theft is its own skill.

Why it matters

The worst part of many attacks is data leaving the company: customer records, card numbers, source code. If you can see and stop exfiltration (data being taken out), you limit the damage even after a break-in.

What it is

DLP = Data Loss Prevention. These are tools and rules that find sensitive data and stop it from leaving without permission. Exfiltration means moving data out to the attacker.

WordSimple meaning
Sensitive dataData that must be protected: card numbers, Aadhaar, health records, passwords.
Data in motionData moving on the network, like an email or upload.
Data at restStored data, like files on a laptop or in S3.
DNS tunnellingHiding stolen data inside DNS lookups to sneak it out.
BaselineNormal traffic, so a big jump stands out.
Sign of theftWhat to check
Large upload to the internetWho, when, to where
Many DNS lookups to one odd domainPossible DNS tunnelling
Big file copied to a USB stickEndpoint DLP log
Data sent to personal cloud or emailEmail and web DLP rule

How to detect and reduce it

  1. Find and label your sensitive data first; you cannot guard what you have not found.
  2. Set DLP rules for patterns like card numbers in email or uploads.
  3. Baseline normal outbound traffic, then alert on big jumps.
  4. Watch DNS for many lookups to one strange domain.
  5. Log USB and personal-cloud use on laptops.
  6. On an alert, block the transfer and start incident response.

Worked examples

Worked example 1: A huge upload at night

  1. Baseline: this server sends about 50 MB out per day.
  2. One night it sends 20 GB to an unknown IP.
  3. The alert fires on the jump; you block the IP and investigate.

Worked example 2: DNS tunnelling

# count DNS lookups per domain in a log; a flood to one odd domain is a red flag
awk '{print $NF}' dns.log | sort | uniq -c | sort -rn | head

Thousands of long, random-looking names under one domain can mean data is leaving inside DNS.

Worked example 3: Card numbers in an email

  1. A DLP rule looks for 16-digit card-number patterns in outgoing email.
  2. An employee tries to email a list of card numbers to a personal address.
  3. The rule blocks it and alerts the security team.

Real incident: Equifax (2017)

1. What happened

Attackers used an unpatched web app bug to get in, then took personal data on about 147 million people over several weeks.

2. Why it went unseen

  1. A device meant to inspect outgoing traffic had an expired certificate.
  2. So the encrypted data leaving was not being checked.
  3. The theft continued quietly for weeks.

3. How to stop it

  1. Keep traffic-inspection tools working and up to date.
  2. Baseline outbound traffic and alert on big jumps.
  3. Patch internet-facing apps fast so attackers cannot get in to begin with.

In short

  • DLP finds sensitive data and stops it leaving without permission.
  • Exfiltration = data being taken out by the attacker.
  • Watch for big uploads, odd DNS traffic and USB or personal-cloud use.
  • Find and label sensitive data before you can guard it.