What is data egress?

Last year was the worst on record for data breaches, so now is the perfect time to review potential security issues your company may face. While most organizations are concerned about exterior threats, data egress is just as important. But what is data egress, and how can you prevent sensitive data loss?

Ingress vs. egress: what’s the difference?

In network activities, egress is traffic that originates within the network and then leaves to an outside location. This data can be outbound emails, messages, files going to external cloud storage, and so on. Ingress is the opposite of egress — it means traffic that is entering your network from outside.

How do criminals use egress traffic to steal data? Usually it’s done using data exfiltration techniques like backdoor Trojans or social engineering disguised as regular network traffic. If your company doesn’t have proper data egress filtering, criminals can exfiltrate data without you even noticing.

How to prevent unauthorized data egress

Monitor your company’s network. The first step is to keep track of what’s happening on your network. Network monitoring enables you measure metrics such as uptime, availability, response time, and helps you detect suspicious activities.

Keep track of data. Locating, identifying and organizing sensitive company data is another good step in data loss prevention. It can help you decide what kind of protection is needed and who can access particular data.

Control access. Implement an authorization policy so each new device connected to the network has to be approved before joining it. With NordLayer you can manage who can access specific resources from a centralized control panel.

Firewall rules. A firewall is a gatekeeper that can manage data ingress and egress. Some companies have been breached precisely because their egress rules enabled intruders to funnel data without anyone noticing. Configure your firewall with the right rules to block potential unauthorized data egress.

Firewall logging. Log data for ingress and egress traffic to manage potentially malicious activities. This data can let you analyze traffic by utilizing SIEM tools (Security Information and Event Management). It compiles, correlates, and manages data across your security systems and other networks. If properly set up, it can help prevent unauthorized data exfiltration.

Incident response. In case a breach does happen, having a response plan can do a lot to prevent further damage to the company. Even with seemingly bulletproof security systems, be prepared for the worst-case scenario.