Artifacts that Attackers Can Collect from You
Traditionally, IT security and cyber security professionals concentrated on protecting the perimeter. The perimeter is the area in our infrastructure that separates the internal infrastructure from the external world. This practice is commonly known as castle security. It was used by conventional security systems to try to protect information from external perpetrators. Most systems were closed systems and the only connectivity to the external world was the internet; this practice was quite acceptable for traditional systems. However, today’s complex requirements and the introduction of cloud systems have made this practice worthless. Also, insiders play an active role in many attacks, meaning security professionals are forced to find a better approach. Since attackers must also access enterprise systems through the perimeter, security professionals can collect indicators of compromise from perimeter devices.
Typically, artifacts...