5.1 Recognizing a Security Breach
Speed is critical. “Dwell Time” (the time an attacker is inside before detection) averages 200+ days. We need to lower this.
-
Indicators of Compromise (IoCs):
-
Technical:
Pop-ups, new admin accounts, disabled antivirus, high network traffic at 3 AM. -
Behavioral:
“MFA Bombing” on your phone, colleagues asking why you sent them a weird email.
-