The discovery of unapproved accounts accessing shared data, along with data discrepancies, strongly indicates unauthorized changes.
* Indicators of Unauthorized Changes:
* Unexpected user permissions found during audits.
* Modified or deleted data without proper documentation.
* Altered system or security configurations, allowing unintended access.
* Why Not Other Options?
* A. Filesystem Anomaly: This refers to unexpected behavior in the file structure, such as corrupt metadata or missing files, rather than unauthorized user access.
* B. Illegal Software: Would involve unlicensed or unauthorized applications, not unauthorized file modifications.
* D. Data Exfiltration: If data was removed, it might be exfiltration, but in this case, data modifications were detected instead.
To prevent unauthorized changes, security teams should use:
* File Integrity Monitoring (FIM) to detect unauthorized modifications.
* Access control audits to verify correct user permissions.
* SIEM tools to analyze logs for anomalies.