Indicators of Compromise

There are plenty of solutions that can help provide indicators of compromise (IoCs). Some will highlight the IP address of an asset, the malware detected, or even unusual patterns in user behavior and password authentication attempts. All of these can be mapped back to the Venn diagram of cybersecurity discussed earlier in the book. The goal of any IoC is to identify when something is inappropriate in an environment, what evidence supports the anomaly, and potentially the root cause—from malware to insider threat. With this in mind, there are four characteristics that can create an identity IoC: