A utility security team worries about sensitive GIS exports leaving the network. What monitoring emphasis best addresses that risk while staying effective over time?
Select an answer to reveal the explanation.
Short Explanation
Data walking out the door is the quiet failure mode — watch the exits, not just the lobby. Monitor egress for exfil tells and keep retuning as traffic shifts. Blind outbound trust or anonymous FTP is asking for a leak.
Full Explanation
Exfiltration often succeeds quietly on outbound paths that organizations under-monitor while focusing on inbound phishing. Municipal GIS, case files, and citizen data can leave through cloud sync, unauthorized APIs, DNS tunneling, large transfers to personal accounts, or misconfigured public shares. Monitoring egress for indicators—unusual destinations, volumes, protocols, and timing—and continuously tuning detections as traffic and threats change gives the city a chance to interrupt loss before it becomes a breach notification crisis. Egress control and detection complement DLP and access governance; none alone is sufficient as patterns evolve.
Ignoring outbound channels while monitoring only inbound phishing email leaves a one-sided defense that misses post-compromise theft. Permanently blocking all internet access for every employee including emergency crews may break mission-critical communications and is rarely a proportionate operational control. Publishing GIS export folders as anonymous FTP to simplify sharing creates an intentional open exit for sensitive geospatial and related data. Exam caveat: availability for emergency services constrains blunt outbound blocks—prefer monitored, least-privilege egress with strong detection. Operationally, inventory sanctioned outbound paths, alert on anomalies to unsanctioned cloud storage, and periodically revalidate firewall and proxy rules against current municipal application portfolios.