Обнаружение атак на данные и приложения

Watching the data

• Accounting 审计记录 logs who accessed what and when.
• A honeypot 蜜罐 is a fake valuable file — any access is a clear attack sign.
• Re-hashing a file reveals if it was altered.

Choosing detective controls

• Honeypots and hash checks are cheap.
• A data loss prevention (DLP) 数据泄露防护 service is powerful but costly.
• More sensitive data deserves closer monitoring.

A hash function gives a fixed-length fingerprint; any change to the data changes the hash