6 ms·
Sure, but that's at least an additional piece of security, requiring additional work to bypass. I totally agree that 100% exfil detection is near impossible. B
by passive 8y ago
Sure, but that's at least an additional piece of security, requiring additional work to bypass.
I totally agree that 100% exfil detection is near impossible. But if you were going to try to get close to it, this is one of the world's databases where you really would want to. Their entire model is about collecting a shit ton of information and providing very heavily controlled access to it. Very well paid people should have spent a lot of time examining how to balance the need to pull in data from many sources, while providing only monetized ways to actually retrieve said data. They're like an old-timey pirate captain, who spends most of her time roaming all over the place in the hopes of being able to plunder someone else's treasure, then hiding said treasure in a safe place.
Except they really didn't take the hiding the treasure part very seriously. ;)
- staticassertion 8y ago> Sure, but that's at least an additional piece of security, requiring additional work to bypass. I would not consider the ability to proxy traffic much of a new capability for attackers. You can do it trivially with a single SSH command. Even a script kiddy with automated tooling should be able to handle this. Agree that detecting exfil when you have sensitive data is very important though. Just that it takes a lot of work to protect against, and a ton of work to detect.