Monitoring and Identifying Data Leaving the Newtork

Thinking specifically about an attack on our network, how could we monitor or what tools are out there for preventing data theft from our network?  I'm talking about suddenly a large amount of data leaving our network which may be as a result of a compromise.  Is there anything that could identify this?

We do use LANGaurdian here and there which has a quota function I believe but I'm not sure if this is for users.  I.e. it alerts when a user exceeds their daily quota, not necessarily when an unknown or external user is shifting vast amount of data from a file server.
LVL 2
jdc1944Asked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
Rich RumbleConnect With a Mentor Security SamuraiCommented:
The issue is, you need to be context aware, and data doesn't have to leave all at once, it can be siphoned slowly which is actually how a lot of the elite groups do their exfiltration. You need to look into DLP technology, and into securing data that is vital. The first step is to ID your data, you can do that with DLP trials, where they sniff and scan for data they typically flag on (SSN, CC, DoB, PII) or you specify your own search terms. Second, securing that data, make sure there are ACL's and controls in place to prevent just anyone getting the data. Only allow those with the need to access the data, Then you can go into a full fledged DLP where it can try to stop or at least alert on the possible exfil of data. It can be quota based by the way. Have a look at the Gartner DLP Quadrant, I like ForcePpoint
https://digitalguardian.com/sites/default/files/2016-gartner-magic-quadrant-for-enterprise-data-loss-prevention-new.png
-rich
1
 
Niten KumarPrincipal Systems AdministratorCommented:
Try PRTG's free network sniffer
1
 
Kimberley from PaesslerPRTG Product EvangelistCommented:
PRTG can help you detect a sudden increase in the amount of data leaving the network, or in the amount of data leaving a file server.  However, we don't look into the payload, so we can't tell you if the increased traffic is a security breach, or just an increase in traffic.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.