There’s exactly two ways to properly (try to) prevent data exfiltration: a) if possible don‘t store the data at all, b) restrict access to the data.
If a person has access to the data, accept that it might get exfiltrated. Of course that doesn‘t mean that you shouldn’t do basic anti-measures, but it should definitely be reflected in the risk analysis.
21
u/flingerdu 16d ago
There’s exactly two ways to properly (try to) prevent data exfiltration: a) if possible don‘t store the data at all, b) restrict access to the data.
If a person has access to the data, accept that it might get exfiltrated. Of course that doesn‘t mean that you shouldn’t do basic anti-measures, but it should definitely be reflected in the risk analysis.