Definition
Indicators of attack, or IOA, represent the observable behaviors and patterns that suggest malicious activity is occurring or has occurred within a system or network. Unlike indicators of compromise which focus on the aftermath of an attack, IOAs aim to detect malicious actions during their execution. This proactive approach allows security professionals to identify and respond to threats before significant damage is done, thereby minimizing impact and protecting sensitive data. For instance, a sudden surge in outbound traffic from an unusual port or a series of failed login attempts followed by a successful one from a new IP address could be an IOA. It is crucial to distinguish IOAs from simple system alerts, as IOAs are specifically tied to the stages of an attack lifecycle. Understanding IOAs is fundamental for roles covered by certifications like CompTIA Security+, CySA+, and CISSP.