A compromised account is rarely just an account problem. Once someone is in, they can often move from…
Esla K. — CyberOps Community Lead
A compromised account is rarely just an account problem. Once someone is in, they can often move from identity into email, then cloud, then the business apps and the data inside them, and eventually into day-to-day operations. How far they get depends on the environment.
So when an alert fires, "was the account compromised?" is only half the question. The one I care about more is what that account could actually reach. Detection and response work better when they know the business behind the login, and that starts with knowing your own attack surface.
#Cybersecurity #SecurityOperations #DetectionEngineering #NcryptoEdge
4 reactions · 0 comments
Topics: #ncryptoedge, #securityoperations, #cybersecurity, #detectionengineering