Patching, Live Monitoring, and Detecting Attacks

4.3.CConcept

Why Patching Actually Matters

When a vulnerability is discovered in an operating system or piece of software, the vendor fixes it and releases an update — often a small, targeted fix called a patch. Keeping a device updated to the most recent version is one of the simplest, highest-value things you can do for its security.

Vulnerability found→Vendor releases patch→Device updates→Door closed

💡An unpatched device isn't vulnerable to some mysterious unknown threat — it's vulnerable to a publicly documented one. Once a patch exists, the vulnerability it fixes is effectively public knowledge, which makes unpatched systems an easy, low-effort target.

4.4.A–BConcept

Two Ways to Detect an Attack

Detection tools work in one of two fundamentally different ways. Signature-based detection compares files or activity against a database of known malware patterns — fast and efficient, but blind to anything genuinely new. Behavior-based (anomaly) detection instead compares live activity to a recorded baseline of normal behavior, flagging anything that deviates from it — regardless of whether it matches any known signature.

⚖️ Signature vs. Behavior — click to compare

Compares files/activity against a database of known malware patterns
Fast — low system resource use
Very few false positives
Cannot detect a brand-new attack with no existing signature

🔑Here's the example worth remembering: a PowerShell process launching from an unusual file path will trigger behavior-based detection — even if that exact file has never been seen before and isn't in any signature database anywhere. Behavior-based detection doesn't need to recognize the malware; it only needs to recognize that something deviated from normal.

4.4.AIoC

Three Types of Indicators of Compromise

An indicator of compromise (IoC) is evidence that an adversary has compromised a device or network. IoCs generally fall into three categories:

Type	Found by looking at
Host-based	Logs and configuration settings — unusual files, unexpected processes, unauthorized config changes
File-based	The files themselves — hash matches to known malware, suspicious file names or paths
Behavior-based	Authentication and access logs — failed logins, unusual login times/locations, privilege escalation attempts

🕵️ Classify the IoC

An executable's hash matches a known malware signature.

4.4.BConcept

Choosing a Detection Method

No single detection method is right for every device. Three criteria drive the decision:

Criterion	What it means
Performance	Behavior-based tools use more system resources than signature-based ones — some embedded devices can't run detection tools at all.
Cost	Licensing detection software, or paying for a third-party endpoint detection and response (EDR) service, both cost money to scale across many devices.
Sensitivity / Criticality	Devices holding sensitive data or running critical services are worth a hybrid approach — combining both detection types — even at higher cost.

ExampleGuided Example — Picking a Detection Method

A school district has hundreds of aging student laptops with limited processing power, plus a single, highly sensitive server that stores student records for the entire district.

Step 1 — Consider the laptops

Limited system resources plus a large number of devices points toward signature-based detection — it's lighter on resources and cheaper to license at scale.

← Back to Activity 1.2.3 Next: Activity 1.2.4 →