1. Suspicious Access Patterns
Identifying suspicious access patterns is easier said than done, Shteiman said, but modern authentication platforms have built-in behavioral analytics to spot abnormal user activity. An employee accessing business data on vacation could be a sign something is wrong, or a worker typically based in Utah observed logging into a system from a location in China should set off a big red flag, Shteiman said. Other signs of a potential problem include data being accessed after hours, files getting copied all at the same time, or an account sending a large number of emails with attachments over a short period of time, Shteiman said.