{"id":4386,"date":"2024-07-09T17:40:39","date_gmt":"2024-07-09T22:40:39","guid":{"rendered":"https:\/\/www.darkreading.com\/cyber-risk\/5-tips-to-minimize-data-exfiltration-before-it-happens"},"modified":"2024-07-09T17:40:39","modified_gmt":"2024-07-09T22:40:39","slug":"5-tips-to-minimize-the-costly-effects-of-data-exfiltration","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/07\/09\/5-tips-to-minimize-the-costly-effects-of-data-exfiltration\/","title":{"rendered":"5 Tips to Minimize the Costly Effects of Data Exfiltration"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

COMMENTARY<\/span><\/span><\/p>\n

No matter the status of your organization, it may be the victim of a cyberbreach. Cases in point: In February, the US <\/span>Cybersecurity and Infrastructure Security Agency (CISA) was hacked<\/a><\/span> via the exploitation of vulnerabilities in Ivanti products the agency uses. The International Monetary Fund (IMF) was also attacked that month, which resulted in the compromise of at least <\/span>11 IMF email accounts<\/a><\/span>. In March, multinational technology giant <\/span>Fujitsu confirmed it was the victim<\/a><\/span> of a cyberattack, where hackers used malware to exfiltrate personal and customer information.<\/span><\/p>\n

Data compromises increased in 2023 by a whopping 78% over 2022, according to <\/span>research from the Identity Theft Resource Center (ITRC)<\/a><\/span>. In 2023, there were 3,025 publicly reported data compromises that impacted 353,027,892 individuals, the ITRC’s “2023 Annual Data Breach Report” said. Of these compromises, 78% were cyberattacks, which impacted 343,338,964 victims.<\/span><\/p>\n

Additionally, the “<\/span>2024 Thales Data Threat Report<\/a><\/span>” found a 27% increase in ransomware attacks last year, with 8% of companies paying the ransom \u2014 generally to decrypt their systems or for the “promise” that their customers’ sensitive data wouldn’t be released.<\/span><\/p>\n

In short, data exfiltration is not a question of if it will happen but rather what to do to mitigate the fallout when it occurs. The best way to get in front of the issue is to review and reduce your data collection before an incident can occur.<\/span><\/p>\n

Is Data an Asset or a Liability? Yes<\/h2>\n

Data exfiltration is the theft of personal or sensitive commercial data for the purpose of extortion, increasing the cost and complexity of incidents, as well as bringing greater potential for reputational damage. Data exfiltration cases are increasing each year, from 40% of incidents in 2019 to 80% in 2022 and “significantly higher” in 2023, according to <\/span>Allianz Commercial<\/a><\/span>. Furthermore, the <\/span>use of artificial intelligence (AI) tools<\/a><\/span> is putting companies at an ever-increasing risk of data exfiltration through insider-driven data exposure, loss, and leaks.<\/span><\/p>\n

As threat actors become more sophisticated, they tend to focus more on the exfiltration of specific sensitive information to demand ransom payments and perpetuate identity fraud and other social engineering attacks.<\/span><\/p>\n

When it comes to data collection, the mindset of “more is better” is wrong. The more data you keep, the more likely it is to include sensitive data \u2014 which is what threat actors are looking for, because they can monetize it.<\/span><\/p>\n

How to Declutter Your Data Collection<\/h2>\n

As the number of incidents and rate of data exfiltration rise, it is more critical than ever to reduce the risk of a cyberattack. This means the time is right to assess your data to better understand where sensitive data is stored and delete anything that you do not need. Here are five tips for getting started:<\/span><\/p>\n

\n
    \n
  1. \n
    <\/span><\/p>\n
    \n

    Classify and track your data.<\/span><\/span> Data mapping is the process of creating a visual representation of your data. It helps you understand the landscape of your organization’s information, including where it resides and where sensitive data is stored. Depending on the size of your organization, you can choose to conduct data mapping manually or use a <\/span>context-based AI scanning tool<\/a><\/span> for an initial assessment of where sensitive data is stored and how much is duplicated.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

  2. \n
    <\/span><\/p>\n
    \n

    Encourage data sanitization.<\/span><\/span> Help employees throughout your organization to rethink their data storage practices. For example, if an employee is storing customer data because they want to reuse the work product or formatting, advise them to create a generic template instead and delete any copies with customer information.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

  3. \n
    <\/span><\/p>\n
    \n

    Have IT and infosec teams meet regularly with each department.<\/span><\/span> Require appropriate individuals from IT and infosec to meet with each department to take stock of its data, where that data is stored, and what sensitive data the department retains. Educate the department on proper storage techniques for sensitive data, such as implementing password protection and <\/span>encryption<\/a><\/span>. To comply with data compliance standards, it is also crucial to determine whether sensitive data should be collected or stored in the first place.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

  4. \n
    <\/span><\/p>\n
    \n

    Implement automatic deletion of unused customer data.<\/span><\/span> Tell customers in advance that you won’t store their data for more than 60 days when idle and that they will need to reshare their data after the 60-day timeline.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

  5. \n
    <\/span><\/p>\n
    \n

    Practice active deletion, too.<\/span><\/span> Do not continue to store old organizational data just because that is what your organization has always done. With the ever-increasing cyber incident liability risk and changing threat environment, sticking to status quo policies is no longer the way to go. Much more risk is associated with data retention than ever before, so practice deletion.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n<\/ol>\n<\/div>\n

    Possessing sensitive digital material exposes your organization to potentially severe legal and business consequences. Remember, storing data has real and substantial financial, legal, and physical costs and consequences. Stop storing data for longer than you need to, especially sensitive data that exposes you to heightened risk in a cyberattack. Implement processes for everyone to keep unused or old data to a minimum. That way, you can minimize the physical and financial cost of storing data and benefit your organization’s bottom line.<\/span><\/p>\n

    Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    COMMENTARY No matter the status of your organization, it may<\/p>\n","protected":false},"author":12,"featured_media":4387,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-4386","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/5-tips-to-minimize-the-costly-effects-of-data-exfiltration.jpg?fit=1800%2C1013&ssl=1",1800,1013,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/5-tips-to-minimize-the-costly-effects-of-data-exfiltration.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/5-tips-to-minimize-the-costly-effects-of-data-exfiltration.jpg?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/5-tips-to-minimize-the-costly-effects-of-data-exfiltration.jpg?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/5-tips-to-minimize-the-costly-effects-of-data-exfiltration.jpg?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/5-tips-to-minimize-the-costly-effects-of-data-exfiltration.jpg?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/5-tips-to-minimize-the-costly-effects-of-data-exfiltration.jpg?fit=1800%2C1013&ssl=1",1800,1013,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/5-tips-to-minimize-the-costly-effects-of-data-exfiltration.jpg?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/5-tips-to-minimize-the-costly-effects-of-data-exfiltration.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/5-tips-to-minimize-the-costly-effects-of-data-exfiltration.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/5-tips-to-minimize-the-costly-effects-of-data-exfiltration.jpg?fit=1800%2C1013&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=4386"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4386\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/4387"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=4386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=4386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=4386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}