Data Exfiltration a Review of External Attack Vectors And

Author’s Accepted Manuscript Data Exfiltration: A Review of External Attack Vectors and Countermeasures Faheem Ullah, Matthew Edwards, Rajiv Ramdhany, Ruzanna Chitchyan, M. Ali Babar, Awais Rashid www.elsevier.com/locate/jnca PII: S1084-8045(17)30356-9 DOI: https://doi.org/10.1016/j.jnca.2017.10.016 Reference: YJNCA1996 To appear in: Journal of Network and Computer Applications Received date: 8 August 2017 Revised date: 18 October 2017 Accepted date: 28 October 2017 Cite this article as: Faheem Ullah, Matthew Edwards, Rajiv Ramdhany, Ruzanna Chitchyan, M. Ali Babar and Awais Rashid, Data Exfiltration: A Review of External Attack Vectors and Countermeasures, Journal of Network and Computer Applications, https://doi.org/10.1016/j.jnca.2017.10.016 This is a PDF file of an unedited manuscript that has been accepted for publication. As a service to our customers we are providing this early version of the manuscript. The manuscript will undergo copyediting, typesetting, and review of the resulting galley proof before it is published in its final citable form. Please note that during the production process errors may be discovered which could affect the content, and all legal disclaimers that apply to the journal pertain. Data Exfiltration: A Review of External Attack Vectors and Countermeasures Faheem Ullah1, Matthew Edwards2, Rajiv Ramdhany2, Ruzanna Chitchyan3, M. Ali Babar1, 4, Awais Rashid2 1University of Adelaide, Australia & 4IT University of Copenhagen, Denmark 2Security Lancaster, School of Computing and Communications, Lancaster University, UK, 3Department of Computer Science, University of Leicester, UK ABSTRACT Context: One of the main targets of cyber-attacks is data exfiltration, which is the leakage of sensitive or private data to an unauthorized entity. Data exfiltration can be perpetrated by an outsider or an insider of an organization. Given the increasing number of data exfiltration incidents, a large number of data exfiltration countermeasures have been developed. These countermeasures aim to detect, prevent, or investigate exfiltration of sensitive or private data. With the growing interest in data exfiltration, it is important to review data exfiltration attack vectors and countermeasures to support future research in this field. Objective: This paper is aimed at identifying and critically analysing data exfiltration attack vectors and countermeasures for reporting the status of the art and determining gaps for future research. Method: We have followed a structured process for selecting 108 papers from seven publication databases. Thematic analysis method has been applied to analyse the extracted data from the reviewed papers. Results: We have developed a classification of (1) data exfiltration attack vectors used by external attackers and (2) the countermeasures in the face of external attacks. We have mapped the countermeasures to attack vectors. Furthermore, we have explored the applicability of various countermeasures for different states of data (i.e., in use, in transit, or at rest). Conclusion: This review has revealed that (a) most of the state of the art is focussed on preventive and detective countermeasures and significant research is required on developing investigative countermeasures that are equally important; (b) Several data exfiltration countermeasures are not able to respond in real-time, which specifies that research efforts need to be invested to enable them to respond in real-time (c) A number of data exfiltration countermeasures do not take privacy and ethical concerns into consideration, which may become an obstacle in their full adoption (d) Existing research is primarily focussed on protecting data in ‘in use’ state, therefore, future research needs to be directed towards securing data in ‘in rest’ and ‘in transit’ states (e) There is no standard or framework for evaluation of data exfiltration countermeasures. We assert the need for developing such an evaluation framework. Keywords: Data Exfiltration, Data Leakage, Data Theft, Data Breach, External Attack Vector, Countermeasure 1. Introduction Data theft (formally referred to as data exfiltration) is one of the main motivators for cyber-attacks irrespective of whether carried out by organised crime, commercial competitors, state actors or even “hacktivists”. Preventing data exfiltration is increasingly becoming a challenging task due to two main reasons. First, over the span of last few years, cyber-crime has transformed from an individual’s act to an organizational act. This transformation has provided attackers (or often called hackers) with high budget, resources, and sophistication to become more professional in data exfiltration. Second, the existing data infrastructure contains several means (as shown in Fig. 1a) that are originally designed for the legitimate exchange of data but can be used for data exfiltration. Fig. 1b shows one scenario of how these legitimate means can be leveraged for data exfiltration. Stage-1: The attacker researches the available means within an enterprise to find some weaknesses that can be exploited to exfiltrate data. Stage-2: Once the weakness has been identified, the attacker launches the attack to exploit the identified weakness. The attack can either be network-based or physical-based. In a network-based attack, an attacker may use different techniques such as phishing email, malware, or some kind of injections. In a physical attack, an attacker may leverage techniques like copying data to a removable device or even get hold on some printed documents. Stage-3: Once the attacker gains the required access to the sensitive data, the process 1 Fig. 1a: Some of the means of Data Exfiltration Fig. 1b: Data Exfiltration Scenario of data exfiltration starts as shown in Fig. 1b. Due to the sophistication of attacks and several available means, there has been a number of data exfiltration incidents reported recently. According to ITRC Breach Report1, until 3rd October 2017, there have been 1056 data exfiltration incidents in 2017. A popular incident reported in June 2017 was the leakage of data of 200 million American voters, which was compiled for Republican National Committee. The data contained personal information of voters that included name, home address, phone number, date of birth, and voter registration details. The leak occurred due to misconfiguration of the database holding the data. Equifax and Deloitte are two of the top companies, which have recently fallen victims to major cyber security attacks that have left millions of people’s private and business data exfiltrated23. Both of the companies were entrusted with the responsibilities of safeguarding that very data that got stolen with known and unknown personal, professional, and business implications for private citizens as well as businesses. ITRC Breach Report has several other incidents among which the most noticeable are shown in Fig. 2. Recently, Verizon released 2017 Data Breach Investigations Report4 that revealed some interesting aspects of this growing concern. According to this report, 75% of data exfiltration attacks were perpetrated by external attackers (i.e., hackers) while 25% of the attacks involved actors within the victim organization. This report also reveals that among all the data leaks, about 24% occurred in the financial sector, about 15% occurred in the healthcare sector, about 15% occurred in retail and accommodation sector, and about 12% occurred in public sector entities. As evident from the above-mentioned statistics, such proliferation of data exfiltration is becoming a serious concern for business and government organizations. For businesses, data exfiltration may cause huge financial and reputational damage by disclosing trade secrets, information about future projects, and customers’ profiles to competitors. For governments, the consequences of data exfiltration can be even more severe when national secrets or information about political settlements fall into the hands of adversaries. Driven by the need to address such a serious concern, security experts develop various security systems that include but not limited to Intrusion Detection System (IDS), Intrusion Prevention System (IPS), firewall, and Security Information and Event Management (SIEM). However, these systems fall short in dealing with data exfiltration due to unstructured and constantly evolving nature of data. To overcome this limitation, security experts and researchers come up with the idea of data exfiltration countermeasures, which specifically aim to detect, prevent, or investigate data exfiltration. Unlike traditional security systems (e.g., IDS, IPS, and firewall), which 1 http://www.idtheftcenter.org/images/breach/2017Breaches/ITRCBreachReport2017.pdf 2 https://www.theguardian.com/us-news/2017/sep/07/equifax-credit-breach-hack-social-security 3 https://www.theguardian.com/business/2017/sep/25/deloitte-hit-by-cyber-attack-revealing-clients-secret-emails 4 https://www.ictsecuritymagazine.com/wp-content/uploads/2017-Data-Breach-Investigations-Report.pdf 2 are supposed to act when an attacker tries to enter the enterprise, data exfiltration countermeasures are expected to work when an attacker is on its way back from the enterprise with the sensitive data. We assert that there is an important need of providing an extensive overview and in-depth analysis of the available literature to connect the knowledge about the current state of the art on this topic. We have carried out an extensive literature review on data exfiltration to derive

Load more