Heuristics like data volume are a good starting point, but also known good traffic flow is important to know. In a "secure" environment you'd route all traffic through a know choke-point that is network controlled. In AWS this would be using the routing layer of the VPC to force traffic to something like a Squid proxy before allowing it out.

On that proxy outbound traffic destination host or IPs would be compared to a list of known destination, and rejected if not match is found.

These methods are not 100%, but they do help add another layer to the security process.

Whitelisting allowed outgoing targets isn't absurd at all. It should be standard practice for anyone running a system remotely like Equifax's. It's not the only type of protection, but if your business is basically a lump of data, you want to know exactly who you're communicating with.

Which just means you need to proxy your exfil with a host that has external traffic, such as anyone's laptop, or an edge server.

Of course, now this means you just need to detect that sort of proxying, which may be easier.

Detecting exfil sucks and is hard.

Sure, but that's at least an additional piece of security, requiring additional work to bypass.

I totally agree that 100% exfil detection is near impossible. But if you were going to try to get close to it, this is one of the world's databases where you really would want to. Their entire model is about collecting a shit ton of information and providing very heavily controlled access to it. Very well paid people should have spent a lot of time examining how to balance the need to pull in data from many sources, while providing only monetized ways to actually retrieve said data. They're like an old-timey pirate captain, who spends most of her time roaming all over the place in the hopes of being able to plunder someone else's treasure, then hiding said treasure in a safe place.

Except they really didn't take the hiding the treasure part very seriously. ;)

> Sure, but that's at least an additional piece of security, requiring additional work to bypass.

I would not consider the ability to proxy traffic much of a new capability for attackers. You can do it trivially with a single SSH command. Even a script kiddy with automated tooling should be able to handle this.

Agree that detecting exfil when you have sensitive data is very important though. Just that it takes a lot of work to protect against, and a ton of work to detect.

So you're going to whitelist every mortgage broker, car dealer, apartment manager, etc who might need to pull a credit report? Doesn't sound practical.

No, not like that. You have a delivery service for your credit reports, which can make outgoing connections as it pleases, that ensures every credit report it delivers is paid for. You invoke it from inside your network, sending it the credit report along with the transaction number. It looks up that transaction to figure out where it needs to deliver the credit report. It doesn't have access to read any of the raw data.

Won't be perfectly secure, but it diminishes a major area of risk.

(There are other architectures that will accomplish the same thing, the key is that if a machine can access the user databases, you should be drastically limiting what kind of outgoing connections it can make.)

> But if they have enough control to tell some system to dump its contents somewhere

This doesn't have to mean that they have full, unrestricted access. Access to data may mean that they could get raw records via some internal API. That API may still have logging, access control, DoS protection, etc.

Just like you can detect and prevent an external person from scraping your website in most cases, you can detect some internal service requesting way more than an average hourly number of records. Or with a better audit - specific verifiable entity (signed employee requests, external request id markers, etc.) requesting more than they should.

That assumes you have well designed system with multiple tiers and assume no trust. It's not possible if every service connects to the same database with yolo-root-access.

I get the impression that they did connect with yolo root access.

>Although the ACIS application required access to only three databases within the Equifax environment to perform its business function, the ACIS application was not segmented off from other, unrelated databases. As a result, the attackers used the application credentials to gain access to 48 unrelated databases outside of the ACIS environment.

This isn't a technology problem. This is an accountability/incentive problem.

If you cannot store data securely then you should not profit from that data. Business models that insecurely store consumer data should not be viable.

There are two approaches to detecting exfiltration that I consider state of the art:

* Network traffic capture for deferred analysis * Egress analysis (including decrypting SSL/HTTPS)

The first approach is, IMO, more realistic. Although you can't prevent the exfiltration, you can detect it lazily after it's happened, including where it went, what was sent, etc. Although I'm sure several companies support this, [Eastwind Networks](https://www.eastwindnetworks.com/) does a great job for Cloud and on-prem workloads.

The second option, while more thorough, requires big boxes to run, doesn't scale well, is hard to install on clients (the only way I know to "break" HTTPS is to install a custom CA on all clients and MITM all public traffic, which would break for sites using HSTS and HTTP Public Key Pinning). It's only vaguely feasible, and is fraught with issues.

My company utlizes Corvill appliances and network taps on the switches to monitor activity. We mostly use it for metrics, but no reason it couldn't monitor exfil. Onky problem is it only has enough storage for about 3-4 days of network traffic.

Ideally, the systems that prevent "infiltration" are separate from the systems that detect (and even prevent) "exfiltration". Just because you breached the firewall, that doesn't mean you can delete all the logs of network traffic passing through it.

It's of course much more difficult than that in practice, but that's the general idea.

Equifax cannot detect exfiltration of your data because distributing your data is their line of business. Your personal details pouring out of their servers at high speeds is what always happens there, 24 hours a day.

If my business is distributing data, the number one thing I would monitor for is that I'm getting paid for the data I distribute. Data that gets distributed for free is nearly the worst thing my software can do, so I should be investing a ton in preventing it.