Which term best describes the act of transferring sensitive data from a protected environment to an external destination without authorization?

Which term best describes the act of transferring sensitive data from a protected environment to an external destination without authorization?

• A. Fraud
• B. Disinformation
• C. Data exfiltration
• D. Extortion

Answer: (C)

Transferring sensitive data from a protected environment to an external destination without authorization is data exfiltration. This term captures the act of pulling information out of a secured network and delivering it outside the organization, often without the knowledge or permission of those who control the data. It’s the movement of data from inside to outside in a way that bypasses normal security controls, making it a core concern in data protection and incident response. This concept helps distinguish the action from other ideas like fraud (deception for gain), disinformation (deliberately false information), or extortion (coercing someone by threats). In practice, you’d look for signs such as unusual outbound data flows, transfers to unfamiliar or restricted destinations, or data being sent over covert channels. Mitigations include data loss prevention tools, monitoring of outbound traffic, strict access controls, and network segmentation to limit where data can move and who can move it.

Transferring sensitive data from a protected environment to an external destination without authorization is data exfiltration. This term captures the act of pulling information out of a secured network and delivering it outside the organization, often without the knowledge or permission of those who control the data. It’s the movement of data from inside to outside in a way that bypasses normal security controls, making it a core concern in data protection and incident response.

This concept helps distinguish the action from other ideas like fraud (deception for gain), disinformation (deliberately false information), or extortion (coercing someone by threats). In practice, you’d look for signs such as unusual outbound data flows, transfers to unfamiliar or restricted destinations, or data being sent over covert channels. Mitigations include data loss prevention tools, monitoring of outbound traffic, strict access controls, and network segmentation to limit where data can move and who can move it.