According to Red Canary & Crowdstrike. “Timing and response plans could mean the
difference between an attempted attack or full-blown compromise”. Hindsight is twenty-
twenty. Eyesight that is! No one has a functional crystal ball. But we can rely on precursors
and indicators to warn us that something is not right.
Incident detection precursors
A precursor signals, that an incident may possibly happen in the future. The basis for
this suspicion has to come from information available publicly. This information has to be
peered viewed and would come via a vendor advisory. A savvy SSCP keeps in touch with
security blogs, and threat intelligence sources. The detection of reconnaissance actions from
an attacker. Precursors let the SSCP foresee a possible impending attack. These signals help
strengthen protection measures appropriately.It is extremely difficult to know when a
system has been penetrated, let alone assertively and properly organize a
reaction to such intrusions, so it’s important to prepare proactively. (1)
