Detecting data exfiltration has always seemed like an impossible problem to me. The implication is that "infiltration" has already occurred, and now the attacker just has to read/send the sensitive data somewhere. But if they have enough control to tell some system to dump its contents somewhere, how could they not have enough control to obfuscate the data itself?
It seems like these systems could only work by either using some heuristic like data volume to decide when something is being "exfiltrated", which isn't nearly as useful, or by whitelisting allowed communications, which seems absurd.
It seems like these systems could only work by either using some heuristic like data volume to decide when something is being "exfiltrated", which isn't nearly as useful, or by whitelisting allowed communications, which seems absurd.
What am I missing?