6.6.2. Anomalous Behavior Recognition

💡 First Principle: Trained employees can detect suspicious activity that technical controls miss. Social engineering, insider threats, and unusual requests are best caught by alert humans who know what "normal" looks like and speak up when something isn't. Technical controls catch known patterns; humans catch the things that feel wrong.

Risky behavior recognition: employees trained to identify and report colleagues performing unusual activities — accessing systems they don't normally use, working unusual hours without explanation, expressing unusual interest in sensitive data outside their job scope, or attempting to bypass security controls. This isn't about creating a surveillance culture — it's about establishing norms where unusual patterns trigger healthy curiosity rather than going unnoticed.

Unexpected resource consumption — employees noticing that their system is unusually slow (potential cryptomining), that disk space is disappearing (potential data staging for exfiltration), or that network connections are unusually active (potential botnet activity). Training users to report performance anomalies rather than simply restarting their machines catches threats that bypass endpoint detection.

Unexplained system behaviors — new programs appearing, unexpected pop-ups, browser redirects, changed homepage settings, or system settings changing without user action. Training employees to report these instead of ignoring them catches malware that automated tools miss. An employee who says "my browser keeps redirecting to strange sites" may be reporting the first indicator of a compromise that EDR hasn't flagged yet.

Social engineering resistance — training employees to verify unexpected requests through independent channels. "Your CEO called and wants you to wire $50,000" should trigger verification through a known phone number, not the one the caller provided. Key principle: the urgency in a social engineering attack is manufactured — legitimate requests can wait for verification.

⚠️ Exam Trap: Social engineering resistance isn't about distrusting everyone — it's about verifying unexpected requests through independent channels. The correct response to a suspicious request from "the CEO" is to call the CEO's known number and verify, not to refuse the request or comply without question.