I know of at least one serious security incident (maybe this is mentioned in the talk but I didn't hear it) in which data was exfiltrated from the victim's netw

I know of at least one serious security incident (maybe this is mentioned in the talk but I didn't hear it) in which data was exfiltrated from the victim's network by patiently making successive dns queries, which were of course unfiltered as they were considered innocuous, for long hostnames in which segments of the data were encoded. It was not an easy thing to patch.