Review reports by users and external contacts about suspicious and unexpected behavior. In security-conscious organizations, users 1 will report suspicious events and behaviors. You, as a system or network administrator, should use those reports along with information you gather, to help identify possible intrusions. When appropriate, you should also use external sources of information, such as reports from incident response teams, to help you in deciding whether or not you need to augment your monitoring and incident analysis efforts. Why this is important Recruiting users and external contacts to assist you in security monitoring greatly extends your ability to detect intrusions, potentially allowing you to detect intrusions of which you were previously unaware.
Intruders often compromise multiple systems when they attack a target site.
At each compromised system, there may be telltale signs of intrusive activities that users of the system discover. Although a single user report may not be sufficient evidence of an intrusion, analysis of several reports may reveal a pattern of attack underway. By consolidating users' reports of suspicious system behaviors, you may also be able to determine how widespread attacks against your networked systems are. Administrators from other organizations may contact you if they have a reason to believe that an intrusion into their systems may involve or affect your organization. Immediately gather as much information as necessary to make an initial assessment of whether there is a probable intrusion and, if so, how severe it seems to be.