Ransom demands and a completely inaccessible system aren’t the only signs of an ongoing cyber incident. In most situations, smaller signs precede larger ones. If a user makes unusual login attempts, accounts change, network traffic looks unusual, security software is disabled, or strange file activity is observed, something is amiss. Recognising these indicators early is an important part of effective cybersecurity.
The problem is that many warning signs may have a legitimate explanation. An incorrect login may be because someone forgot a password, and strange network activity may be related to a new application or system update. So not every anomaly proves a breach. Instead, investigate suspicious events in context. To establish a baseline of normal activity and detect deviations, CISA suggests using logging and monitoring. Logs can include user access, admin changes, network activity, and application logins, which can help during investigations of likely unauthorised activity.
Watch for Unusual Login and Account Activity
One of the first places to look for signs of a possible compromise is user accounts. Therefore, cybersecurity monitoring should closely track authentication activity, account changes, and unrecognised administrative privileges. Multiple failed logins may be a red flag, especially if they occur across multiple accounts or from a new computer or system. CISA guidance suggests reviewing authentication logs for unusual patterns, such as multiple failed logons, unusual logon locations, dormant account usage, or unusual privileged account usage.
Successful logins may also be suspicious. An employee account that logs in late at night, from an unusual country, or from multiple countries over a short period may merit review. Even if location anomalies appear, they may be legitimate VPN providers or mobile networks, so consider context. Other red flags include password resets, account lockouts, adding new user accounts, or unusual permission changes. CISA has specifically highlighted unauthorised account creation, privilege escalation, and unexpected account lockouts as activities that may warrant further investigation.
Focus on administrative privileges, as a higher-level privileged account can give attackers access to much more. If an unexpected elevated permission is given to an account that is used normally by an employee, that account should be reviewed immediately. Good monitoring should establish a baseline for what “normal” looks like for each organisation. If the employee is a regular traveller, his logon may be quite different from a normal office worker.
Investigate Unexpected Device, Software and File Changes
Computers and servers may also exhibit indications that something is amiss. Cybersecurity teams should not ignore changes that aren’t associated with approved updates, users, or normal system administration. Repeated crashes, abnormal system restarts, new software, deactivated antivirus protection, or unexpected configuration changes may warrant investigation. CISA identifies possible indicators of a cyber incident, including untraceable configuration changes, repeated crashes, malware alerts, or unexpected file modification or destruction.
Additional clues may be obtained from files. Staff may notice files vanishing, file names changing, new files appearing, or information being altered without explanation. In more severe cases, ransomware can encrypt large numbers of files and prevent them from being used. Unexpected security tool behaviour can be significant. Attackers may try to disable antivirus software, disrupt backups, or alter logging systems to make activity harder to trace. In its ransomware guidance, CISA suggests examining endpoint changes, unintended use of privileged accounts, and changes to backups or recovery during an incident investigation.
Devices running at a high CPU load, suddenly consuming storage space, or becoming unusually slow are also good reasons to investigate, but they may have many legitimate causes. Similar behaviour can be caused by a failing application or software update. The best strategy is thus to compare the activity with some known normal activity. Security tools, change-management records, software inventories, and system logs can show whether an unusual change was authorised.
Monitor Network Traffic and Communication Anomalies
Additional early warning indicators come from network activity. Cybersecurity monitoring can detect when systems start communicating unusually or sending unusually large volumes of information. Organisations need to create a baseline of normal network activity. This can comprise normal traffic volumes, commonly used services, identified external connections and frequent communication between internal systems. With this baseline in place, large deviations become easier to detect.
CISA suggests centrally logging and monitoring network behaviour to detect abnormal behaviour sooner. Its alerts detail traffic anomalies, suspicious logins, unusual ports and outbound connections that might warrant investigation. This could be a workstation that starts sending large amounts of data outside normal working hours. Another might be a server communicating with an unfamiliar external address under unusual circumstances.
Other ports and protocols can also be considered. Indicators of a cyber incident include unusual activity on network ports and traffic that deviates from what is normally expected. CISA identifies unusual activity on network ports and traffic that varies from expected as indicators. Other tips can be gleaned from email activity. If an employee’s account receives or sends many bounced messages or outbound emails without the employee’s knowledge, it could mean credentials or systems have been compromised. NIST incident-handling guidance also lists other possible indicators, including unusual login activity, suspicious email activity, and deviations from normal network traffic.
Respond Quickly When Several Warning Signs Appear Together
Several odd events in a row can be more concerning than a single anomaly. Cybersecurity teams should therefore not assess alerts in isolation. Suppose a user logs into their employee account from a strange location, is granted administrator privileges shortly after, and then accesses many files. Each event matters on its own, but together they may indicate a breached account being used to increase access. An antivirus alert followed by disabled security software, unexpected outgoing network activity and a change in the backup settings may warrant immediate investigation.
CISA suggests that the following types of events be monitored, and that adequate logs be kept for incident response: Failed authentication attempts, Privilege escalation. Staff should be familiar with the procedure for reporting suspicious behaviour. The incident response process should describe the person(s) who receive the reports, who investigate them, who can isolate systems, and how internal and/or external communication will be done.
Organisations should also avoid erasing or rebooting systems or files immediately if they are suspicious, without considering evidence preservation. Logs, memory, system images or other information could be valuable depending on the incident, to establish what happened. Containment may be achieved by isolating a vulnerable device from the network, deactivating a compromised account, blocking access to malicious traffic or limiting access to sensitive resources. Decisions should align with the organisation’s incident-response procedures.
Conclusion
Cybersecurity breaches can sometimes come as a surprise. Small signs may appear before the organisation becomes aware of the problem, so awareness, logging, and monitoring are essential for early detection. One key warning sign is unusual login behaviour. Unusual login patterns, geotargeting, new accounts, and activity on dormant accounts can all warrant investigation. Other clues may appear in the devices and software. Don’t assume changes in settings, missing or altered files, repeated crashes, disabled security features, or strange behaviour are intentional or malicious. Network behaviour should also be considered.
GET IN TOUCH WITH THE DIGITAL SCHOOL OF MARKETING
Equip yourself with the essential skills to protect digital assets and maintain consumer trust by enrolling in the Cyber Security Course at the Digital School of Marketing. Join us today to become a leader in the dynamic field of cybersecurity.
