Data Exfiltration Analysis

Defenders guard the doors; data leaves through the windows. Once an attacker (or insider) has read access, the question is no longer if they can see the data but how they get it out — and there are far more channels than anyone defends.

Classify the data and its egress paths

1. What's worth stealing: PII, credentials, financial data, source code, model weights, business secrets. Rank by impact; you can't equally protect everything.
2. Where it concentrates: databases, backups, logs, analytics pipelines, data warehouses, caches, and the laptops/notebooks where humans pull it for analysis. Data sprawls far beyond the primary store.
3. The legitimate egress paths: exports, reports, APIs, third-party integrations, email, file shares. Most exfiltration uses authorized channels in unauthorized ways, not exotic hacks.

The channel taxonomy (overt to covert)

• Bulk authorized: a compromised account uses the export/report/API feature to pull everything. Volume and pattern, not the channel, are the tell.
• Slow drip: small amounts over time to stay under volume alerts.
• Side channels: error messages, timing, response sizes, and verbose logs that leak data piecemeal to an observer.
• Covert channels: DNS exfiltration, encoding data in image metadata, ICMP, or steganography — bypasses content inspection by hiding in allowed protocols.
• Third-party hops: data sent to an integration/SaaS that's then accessible to the attacker, or an over-permissioned analytics SDK shipping data out.

Adversarial validation

• Assume read access: an attacker has compromised one account/service with legitimate read. Enumerate every way they move that data outside the perimeter. The list is always longer than the egress controls.
• The export feature as a weapon: can a single user export the entire dataset? Is there volume limiting, rate limiting, and alerting on bulk reads?
• DNS and "allowed" protocols: is outbound DNS/HTTP unrestricted? Those are the default covert exfil paths because they're never blocked.
• Logs as a data store: do logs/traces contain the sensitive data itself, and who can read the logging system? Observability often has weaker access control than the database.
• Insider with legitimate access: the hardest case — they're authorized. Detection shifts from access control to anomaly detection (unusual volume, time, destination).

Non-obvious risks

• Egress filtering is widely neglected; most networks allow nearly unlimited outbound, making exfiltration trivial once inside.
• Aggregation and inference: individually-innocuous fields combine to re-identify or reconstruct sensitive data; field-level controls miss this.
• Backups and lower environments (staging with prod data) are softer targets holding the same data as production.

Output structure

Deliver: the sensitive-data inventory ranked by impact and where it sprawls, the egress channel map (authorized, drip, side, covert, third-party), the "assume read access" exfiltration walkthrough, the gaps in volume limiting / egress filtering / log access, and detection recommendations (anomaly on volume/destination) for the channels that can't be blocked outright.