Threat-Specific
Data Exfiltration Investigation
Framework for investigating data loss incidents and determining regulatory notification requirements.
Threat-Specific · advanced · Days to weeks
Investigation procedures for suspected or confirmed data exfiltration incidents.
Steps
5
01
Initial Detection Assessment
Evaluate the exfiltration indicators.
- Identify the detection source (DLP, SIEM, user report)
- Document initial indicators
- Assess data sensitivity of potentially affected data
- Determine if exfiltration is ongoing or historical
02
Scope Determination
Identify what data may have been exfiltrated.
- Analyze DLP logs for transferred files
- Review network logs for data volumes
- Identify destination of exfiltrated data
- Catalog affected data types and records
03
Source Investigation
Determine how the exfiltration occurred.
- Identify the user or system responsible
- Determine if insider, external attacker, or accidental
- Trace the attack chain if external
- Identify root cause
04
Regulatory Assessment
Evaluate notification and reporting requirements.
- Catalog affected data types (PII, PHI, PCI, etc.)
- Identify applicable regulations
- Determine notification timelines
- Engage legal for breach determination
05
Remediation
Stop the bleeding and prevent recurrence.
- Block exfiltration paths
- Revoke compromised access
- Implement additional DLP controls
- Address root cause vulnerabilities
Checklist
- Detection source identified
- Initial indicators documented
- Data scope estimated
- Destination identified
- Source/method determined
- Root cause identified
- Regulatory requirements assessed
- Legal engaged for breach determination
- Exfiltration paths blocked
- Affected individuals identified
- Notification plan developed
- Incident documented
Evidence
- DLP alert details
- Network flow data
- File transfer logs
- User activity logs
- Data inventory of affected records
- Regulatory assessment documentation
Communication
- Legal notification memo
- Regulatory notification template
- Customer notification template