Exfiltration
PCIComplianceHubLast updated
Moving data out of an entity's control without authorisation: the step in a compromise where the attacker takes what they came for. E-skimming exfiltrates card data straight from the shopper's browser; a server compromise exfiltrates it from storage or logs. Egress controls under 1.3.2, which restrict outbound traffic from the CDE to what is necessary, and change and tamper detection under 11.6.1, which alerts on unauthorised changes to payment page scripts and headers, are the controls written against it.
Applies to. PCI DSS v4.0.1 does not use the word exfiltration. It meets the concept in three places: Requirement 1, where outbound traffic from the CDE must be restricted to what is necessary so stolen data has no easy path out; Requirement 11, where change and tamper detection on payment pages is meant to catch the script changes e-skimming relies on; and Requirement 12, where a suspected loss of account data triggers the incident response plan.
Related. Data Breach, E-Skimming, Compromise, Incident Response Plan, Network Security Control (NSC)
Sources. PCI DSS v4.0.1 (June 2024)