Recognizing Security Breaches and Indicators

In this lesson, we'll learn to spot the red flags of a security breach. Understanding these signs is crucial for quick incident response.

A security breach is any unauthorized access to or disclosure of sensitive data, or disruption of system operations due to a security incident.

Before we spot a breach, let's understand how attackers get in. An attack vector is the path or method used by an attacker to gain unauthorized access to a system or network.

• They exploit weaknesses in software.
• They trick users into giving access.
• They leverage misconfigured systems.

One common attack vector is phishing. This involves tricking individuals into revealing sensitive information or installing malware.

• Emails pretending to be from trusted sources.
• Fake login pages to steal credentials.
• Social engineering manipulates people into performing actions or divulging confidential information.

Malware (malicious software) is another major vector. It includes viruses, worms, Trojans, and ransomware.

Ransomware encrypts your data and demands payment for its release. Malware can be delivered via email attachments, malicious websites, or infected USB drives.

Attackers often look for vulnerabilities – weaknesses in software, hardware, or configurations – to exploit.

• Unpatched software with known security flaws.
• Default or weak passwords.
• Misconfigured cloud services or network devices.

Regular patching and security audits are vital.

An Indicator of Compromise (IoC) is forensic data found on a network or operating system that indicates a probable intrusion.

IoCs act like clues left behind by an attacker. Recognizing them quickly helps contain the damage.

Keep an eye on network traffic for anything out of the ordinary.

• Unexpected high outbound traffic.
• Connections to suspicious IP addresses.
• Unusual port activity or protocol usage.
• Repeated failed login attempts from external sources.

These could signal data exfiltration or command-and-control communication.

Changes to user accounts are strong indicators of a breach.

• New, unauthorized user accounts appearing.
• Existing accounts with changed permissions.
• Login attempts from unusual geographic locations or at odd hours.
• Password reset requests for privileged accounts without user initiation.

Monitor authentication logs closely.

Attackers often modify files or system configurations to maintain access or hide their tracks.

• Unexpected changes to critical system files.
• New, unfamiliar files appearing in unusual directories.
• Antivirus software being disabled or stopped.
• Unexplained system crashes or reboots.

File integrity monitoring can help detect these changes.

A system under attack might show signs of strain.

• Sudden, unexplained spikes in CPU or memory usage.
• Slow application response times.
• Increased disk I/O activity.

These could indicate malicious processes running, data being encrypted, or a denial-of-service attack.

Which of the following scenarios is the strongest indicator of a potential security breach?

We've explored common attack vectors like phishing and malware, and learned to identify key Indicators of Compromise (IoCs).

• Attackers use various paths to gain access.
• IoCs are clues left behind, like unusual network activity or account changes.
• Early detection is vital for effective incident response.

Keep monitoring your systems and stay vigilant!