A good attacker attempts to mimic valid network traffic and system processes. Fortunately, because every additional piece of malware running on a system increases noise level, it can also be a great tip off for IT. A sudden spate of newly installed programs, automated processes starting and stopping, or system activity during abnormal times are all potential signs of a serious problem on the network.
Last but not least, are smokescreens. Time and again, we've seen hackers start big campaigns with a large DDoS attack in order to throw security staff off track. While IT is working to mitigate the attack and keep websites up and running, hackers can infiltrate other areas unnoticed. When dealing with a DDoS attack, remember to keep an eye on the back door as well.
It is important for IT to be aware of user and attack trends, while remaining alert for signs of a breach - both large like a DDoS, and small, like several data filled emails going to the same place around the same time. A successful compromise can result in customer data exposure, such as account credentials, credit card data or Social Security numbers; however with a little research and a lot of observation, IT can stop data breaches, and the cybercriminals perpetuating them, in their tracks.
Sign up for CIO Asia eNewsletters.