Cisco CyberOps Associate (CBROPS) 200-201Security MonitoringMedium
A security analyst is investigating a suspected insider threat. The SIEM shows a user account, 'jdoe', accessing a large number of sensitive financial documents from a network share at 3 AM, outside of normal business hours. 'jdoe' is an authorized user of these documents during the day. What type of security event data analysis would be most effective in detecting this specific anomaly?
- ASignature-based analysis
- BBehavioral analytics (UEBA)
- CVulnerability scanning
- DNetwork flow analysis
Show answer & explanationAnswer & explanation
Correct answer: B. Behavioral analytics (UEBA)
The key here is that 'jdoe' is authorized to access the documents, but the access occurs outside normal business hours. This represents a deviation from the user's typical behavior, making behavioral analytics (UEBA) the most effective method for detection, as it baselines normal user activity.
Why the other options are wrong
- A. Signature-based analysis relies on known attack patterns, which isn't applicable when an authorized user performs an unusual but not inherently 'malicious' action.
- C. Vulnerability scanning identifies weaknesses in systems, not anomalous user behavior.
- D. Network flow analysis can show traffic volume, but wouldn't inherently flag 'authorized user accessing authorized files at an unusual time' as an anomaly without behavioral context.
User and Entity Behavior Analytics (UEBA)
UEBA is a cybersecurity process that leverages machine learning and statistical analysis to detect anomalous activities by users and other entities (e.g., hosts, applications) that may indicate a security threat.
- Establishes a baseline of normal behavior.
- Detects deviations from this baseline (e.g., unusual login times, data access patterns).
- Effective for insider threat detection and compromised accounts.
- Requires continuous data collection and sophisticated algorithms.
Memory trick: SIEM analysis techniques are like different lenses to view your security data.