How to Spot Indicators of Compromise While Working from Home

by Daniel Bartucci 0 Comments

Indicators of compromise (IOC) are evidence of a cyberattack that help you and your employees detect threat activity, like phishing scams or loss of sensitive data. The sooner you can discover malicious activities, the easier it is to minimize damage or loss.

Educate End-Users on How to Spot IOCs

Do you know whether your users can spot indicators of compromise? Can they keep devices and company data safe with a high degree of success?

Phishing emails can be easy to identify, but some are fairly sophisticated. Have you trained your employees to recognize those and what to do when they find them?

Here are some activities users can look for that may indicate data compromise or malicious intent:

  • Anti-virus software detects an infection
  • Locked out of accounts even though the password is correct
  • Email inbox shows a large number of bounced messages
  • Odd pop-ups, redirected website pages, or odd web browsing activities
  • Ransomware (holding your data hostage in exchange for money)
  • Templates that imitate client accounts
  • Unusual traffic on the network

What do you do if you realize a device and data are compromised? First of all, never try to resolve security incidents on your own. Always seek technical assistance.

Most firms are mature enough to have a process for reporting suspicious activity to a designated person or group. That process may involve calling your Managed Service Provider (MSP), like Agio.

Remember, when dealing with security incidents, time is of the essence. Early reporting minimizes damage to your organization and speeds up containment and resolution.

Perform Incident Response Tabletops Now

If a bad actor was hiding in your network, would you know?

It’s not just a good idea to develop an IR plan, in these times it’s required. It’s a matter of time before you or your clients are targeted by bad actors happy to avail themselves of your assets. 

Indicators of compromise are an essential part of remediation. When you know which IOCs to look for, you can find damage quickly and remediate efficiently.

So, have a seat with your team and walk them through how to respond to IOCs. A good tabletop exercise identifies your strengths and weaknesses. Here are a few questions to ask:

  • What should you do when you encounter a breach?
  • What is the chain of command (and the associated tasks)?
  • What should the response be?
  • What resources are available?
  • How will you use those resources?

Agio’s Managed Detection & Response (MDR) and Cybersecurity services can guide you through this exercise and continue education and testing to ensure your data is locked up tight.

In Conclusion

There are many factors to consider when your users are working from home. A false sense that your device is secure is at the top of that list. Agio’s MDR service partners with you to host employee awareness seminars to train users to spot IOCs and report them immediately. We also guide you in creating and implementing an IR plan that you and your team can follow without question.

If you have questions about IOCs or want to talk more about Agio’s MDR and Cybersecurity services, give us a call. We’re here for you.