What is compromised in cyber security?

During a cybersecurity incident, indicators of compromise (IoC) are clues and evidence of a data breach. These digital breadcrumbs can reveal not just that an attack has occurred, but often, what tools were used in the attack and who’s behind them.

IoCs can also be used to determine the extent to which a compromise affected an organisation or to gather lessons learned to help secure the environment from future attacks. Indicators are typically collected from software, including antimalware and antivirus systems, but other artificial IoC cybersecurity tools can be used to aggregate and organise indicators during incident response.

As much as malware authors try to create software that always avoids detection, every application leaves evidence of its existence on the network. These clues can be used to determine whether the network is under attack or a data breach has occurred. Forensic investigators use these clues to aggregate evidence after a cybersecurity incident to prepare countermeasures and pursue criminal charges against an attacker. IoCs also reveal what data was stolen and the severity of the cybersecurity incident.

Think of indicators of compromise as the breadcrumbs left by an attacker after a cybersecurity incident. Anti-malware applications could partially stop the incident, but indicators of compromise determine the data and files that were accessible to an attacker. They are crucial in finding vulnerabilities and exploits used by attackers to steal data because they offer the organisation information on the ways to better protect the network in the future.

What is an IoC compared to an IoA? Cybersecurity incidents have several phases. But in terms of investigations, there are two main concerns—is the attack ongoing, or has the issue been contained? Investigators use the indicators of compromise left by an attacker to answer both questions.

IoC security used during incident response is used to determine the extent of an attack and data breached. Indicators of attack (IoA) are used to determine whether an attack is ongoing and must be contained before it can cause more damage.

Both IoC cyber tools and IoA tools work with evidence and metadata that give investigators clues into the state of an attack. Indicators of compromise are used after an attack was contained, when the organisation needs to know where, what, and how. Indicators of attack focus on a current attack that may be active and must be contained.

For extremely stealthy malware, a compromise could last for months before administrators are aware of it. IoAs will help determine whether suspicions are accurate or a false positive.

Large networks could have thousands of IoCs. For this reason, most evidence is aggregated and loaded into IoC security event and event management (SIEM) systems to help forensic investigators organise data. Evidence can come from numerous locations, but here are a few discovery items that can be used as IoC:

After an incident, IoC cybersecurity measures can be used to establish what went wrong so that the organisation can avoid any future exploits from the same vulnerability.

In some cases, organisations fail to properly log and monitor the right resources. That oversight leaves them open to an attacker who can then avoid detection after an investigation. It’s important first to apply monitoring on the network to detect an attack, but for investigations, logs and audit trails are just as important.

IoC data points can be collected in real time to reduce response time during an investigation. SIEMs are used to separate noise from valuable evidence needed to identify an attack and its exploit vectors. Documenting current incident response procedures can also reduce the time it takes for an investigation. These procedures should be reviewed after a compromise to improve on them.

During incident response, the “lessons learned” phase is the last step. IoCs are be useful during this phase to identify what cybersecurity defences were incorrectly configured or insufficient to stop an attacker. The more thorough logs and audit trails organisation have, the more effective their investigation during incident response.

Learn how to protect your company against business email compromise (BEC) using Proofpoint's Business Email Compromise Protection – learn what it is and how it works.

You’ve probably heard of the term Business Email Compromise (BEC) before. But maybe not the term Email Account Compromise (EAC), which is a close cousin of BEC.

As fraudsters become more sophisticated, we’re seeing more BEC variants such as gift card scams, payroll diversion and supplier invoicing fraud.

A compromised account happens when it is accessed by threat actors to steal data and/or for financial gain. Read on to learn the meaning and how to prevent it.