Which security technique should be used to prevent data exfiltration?

Data Loss Prevention (DLP) is a security strategy and set of tools designed to ensure that sensitive or critical information is not lost, misused, or accessed by unauthorized users. DLP systems are specifically engineered to prevent data exfiltration by enforcing policies for data at rest, in motion, and in use. They can detect and block the unauthorized transmission of sensitive data through various channels like email, web uploads, or removable media. This makes DLP the most direct and appropriate technique for preventing data exfiltration among the choices provided.

A. Intrusion Detection Software (IDS): An IDS monitors network or system activities for malicious actions or policy violations and reports them. It is a detective control, not a preventative one.

C. Multi-Factor Authentication (MFA): MFA is an access control mechanism that enhances security by requiring multiple verification methods. It prevents unauthorized access but does not stop an authenticated user from exfiltrating data.

D. Intrusion Prevention Software (IPS): An IPS is a preventative control that actively blocks detected threats and exploits at the network level. While it can stop attacks that might lead to exfiltration, it is not primarily focused on the data content itself, unlike DLP.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53, Revision 5).

Reference: Control Family PE (Physical and Environmental Protection), Control ID PE-19 "Information Leakage".

Content: This control specifically addresses measures to "protect information from unauthorized disclosure," which is the core function of DLP systems in preventing data exfiltration. The discussion notes for this control mention monitoring physical and logical egress points.

2. Asaf, M., & Zeadally, S. (2021). Data Leakage Prevention: A Survey. ACM Computing Surveys, 54(4), 1–37.

Reference: Section 2, "DLP Systems," pp. 3-4.

DOI: https://doi.org/10.1145/3447873

Content: This peer-reviewed academic survey defines DLP as a "set of technologies and processes that are used to detect and prevent the unauthorized use and transmission of sensitive information outside the corporate network." This directly aligns with the goal of preventing data exfiltration.

3. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 18(7), 387-408. (Foundational principles often cited in university courseware).

Reference: Section I.A.3, "Least Privilege," p. 391.

Content: While MFA enforces authentication, it doesn't enforce the principle of least privilege regarding data access and movement. A legitimate, authenticated user can still exfiltrate data they have access to. DLP helps enforce policies that limit what even an authenticated user can do with sensitive data, thus supporting the principle of least privilege in the context of data movement.

4. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Massachusetts Institute of Technology.

Reference: Lecture 19 Notes: Network Security.

Content: The lecture notes differentiate between Intrusion Detection Systems (IDS) as passive monitoring systems ("log and alert") and Intrusion Prevention Systems (IPS) as active systems that can drop malicious packets. This highlights that while IPS is preventative, its focus is on blocking network attacks, not on content-aware data exfiltration, which is the specific domain of DLP.