As cyber security professionals.
One thing that's really going to help us do our job is called indicators of compromise or IOC.
These indicators of compromise are just little clues, sometimes called artifacts, because there will
be a little left over kind of dropping right.
It reminds me of when we are doing hunting for pests.
Unfortunately, I've had homes with mouse and even homes with rat problems in the past.
I know it's gross, but one of the things that you do when you're hunting for these pests is look for
their little artifacts or droppings, forensic data.
That might be evidence that you are being maybe surveilled, maybe there's reconnaissance being carried
out against your organization, maybe there's active attack traffic.
So a lot of times we take these clues in these artifacts as indicators of compromise.
Notice, these aren't really considered full blown intelligence reports or anything like that.
We're not creating some revolutionary new attack database or anything like that when it comes to security
intelligence.
But these little nuggets of information can be quite important when it comes to us properly defending
our network.
Notice that you're going to have to be engaging in continuous monitoring, which I hope you would be
doing anyways, in order to be even able to catch any of these indicators of compromise and properly
document them as you should.
Now, there is categories that we like to kind of lump them into, and this is going to help us because
of course, you don't want to be approaching this haphazardly.
So we'll often look for indicators of compromise around email systems, since this is so often a way
initial attacks can get through, we will be being very careful about network indicators of compromise
and those that we find on machines will be host based.
Now, behavioral is the category here that students will sometimes struggle with, and this shouldn't
be a struggle.
Just remember that the behavioral indicator of compromise means something to do with traffic that is
out of the ordinary.
So if we all of a sudden start seeing bizarre traffic flows, let's say moving from one of our key servers,
flows that are very conspicuous for quote unquote normal activity, this can often be the behavioral
indicator of compromise that sets off alarms and allows us to defend our environment properly.