5.1 Recognizing a Security Breach
Speed is critical. “Dwell Time” (the time an attacker is inside before detection) averages 200+ days. We need to lower this.
-
Indicators of Compromise (IoCs):
-
Technical: Pop-ups, new admin accounts, disabled antivirus, high network traffic at 3 AM.
-
Behavioral: “MFA Bombing” on your phone, colleagues asking why you sent them a weird email.
-