Anomalous activity that significantly deviates from normal patterns could indicate a security breach. Examples are provided of outliers that may warrant further investigation, such as a single IP address sending over 100,000 tweets in one day, an employee uploading 4.5 GB of files to an unsecured cloud service, or a manufacturing employee uploading 48.7 GB of data to an external sharing site in a single day. The document recommends monitoring for anomalous outliers to detect potential breaches early before they can seriously impact the business.

1. Brought to you by !
How to Find Security Breaches
Before they Sink Your Business

2. Security breaches can put your
company on the front page

3. That’s why you need to
find them early
To stop the breach and
minimize exposure
But how do you tell if it’s normal behavior or
something to be worried about?

4. Breaches create outliers. In mathematical terms,
they are several standard deviations outside of
normal activity

5. You can think of them as being at the very
edge of the bell curve
Anomaly

6. Let’s take a look at some
examples

7. 104,338 tweets
in 1 day from
1 IP address
Bot exfiltrating data from bank…
140 characters at a time

8. An employee uploads
Employee
leaving
organization
4.5 GB of files to
Kanbox
Risky Service : No compliance
certifications
Terms & Conditions: Collects and
shares data with third parties
Location: Hosted in China

9. Single authenticated user at
retail company tries to connect
to GoToMyPC…
11,101,872 times
in a week.
User device infected with malware
!

10. Single IP address at energy company
attempts to connect to Facebook,
which was blocked...
3.8 million times.
Malware attempting to connect to its
command and control site

11. Manufacturing employee has 188 uploads
totaling 48.7 GBs in 1 day to Ryu Share
Data sent to a Drop Zone outside of
company’s jurisdictional location.

12. Except as otherwise expressly permitted by
these Terms, any Code submitted to
SourceForge.net must be licensed to
Slashdot Media and other licensees under a
license that is: compliant with the Open
Source Initiative (“OSI”)’s Open Source
Definition (http://www.opensource.org/
docs/osd) or certified as an “OSI-Approved
L i c e n s e ” ( h t t p : / / o p e n s o u r c e . o r g /
licenses).”
65 KB upload to open source code repository
Loss
of
Proprietary
IP

13. The definitive guide to the top
cloud services and usage trends
Brought to you by !
DOWNLOAD NOW
Cloud Adoption & Risk Report