The Exfiltration Tax

## The claim being tested "We block removable media and personal webmail, so data cannot leave" is one of the most common wrong answers in a security interview, and it is wrong in an instructive way: it treats exfiltration as a *channel* problem when it is an *authorisation* problem. The two named controls do real work - they remove the two exits an unsophisticated actor reaches for first. What they do not do is remove the class of exit, because in a modern document estate several exits are load-bearing for the business. ## What a permitted carrier looks like Picture a document-heavy SaaS tenant: shared drives, a search service the platform itself provides, and a sanctioned object-storage destination in the same cloud provider. An actor - an external operator who has taken over one account, or an insider whose job is to read these documents - has broad read access and needs to move a set of files outward. Available to them, with nothing installed and nothing unusual: - **A sharing link.** The platform is designed to publish a document to someone outside the tenant. Creating one moves nothing across the network from the victim's side at all; the recipient pulls it. - **A sanctioned sync client.** Files placed in a synced folder leave as ordinary, encrypted, business-critical traffic to the vendor the company pays. - **An export to the tenant's own object storage**, then a copy from there. Both hops are inside services the estate permits. - **An upload to a bucket the operator controls in the same cloud provider.** This is the one that surprises reviewers. If the destination is a *pre-signed URL*, the authorisation to write is embedded in the URL itself, along with an expiry - the request does not authenticate as anyone in the victim's tenant, and no credential of the victim's is involved. To the estate it is a `PUT` to a hostname belonging to a provider that hosts a large fraction of the internet. None of those needs a USB port or a consumer mail account. ## Why blocking carriers one at a time is a losing race Carriers are substitutable and cheap; the operator picks whichever the estate permits, and permitted destinations exist because people need them. Close consumer webmail and the share link remains. Close external sharing and the sync client remains. Close the sync client and you have broken the product the business bought. Each closure raises the operator's cost by minutes, because the choice of carrier is the last decision in the sequence and the one with the most alternatives. What the operator *cannot* substitute is read access to the documents. Everything before the transfer - finding out which of a million files is the one, and getting a copy of it into one place - depends on what a single identity is allowed to read. That is the dependency worth attacking. ## The insider case makes the point sharply An employee whose job is to read the customer folder needs no exploit, no implant and no unusual behaviour to obtain the data; obtaining it *is* their job. For that person the only meaningful question is what they are permitted to read, because copying is indistinguishable from working. A control that filters exits has nothing to say about someone who is entitled to the content and can pick from a dozen permitted destinations. ## How to answer this in an interview Say the two controls are worth having and name what they cover: the ad-hoc, low-effort exit. Then reframe: in a SaaS estate the outward paths are business-critical and encrypted, so the honest defence is narrowing standing read scope so that any one identity - taken over or trusted - can assemble far less. Finish by noting that the carrier is chosen last, from what is permitted, which is why an inventory of blocked exits is not a statement about exposure. ## What not to say Do not claim that encrypting the transfer is what defeats the controls; the controls named never inspected content in the first place. Do not claim that a bulk copy must involve malware - a share link and a browser are sufficient. And do not answer with a longer list of carriers to block, because listing carriers concedes the frame the question is testing.