Noticing problems early.
WHAT TO MONITOR
Successful logins, and from where Failed login attempts New accounts created Permission changes Devices with active sessions
WHAT INDICATES A PROBLEM
A successful login you did not make Logins from unexpected locations Accounts you did not create Permissions granted that you did not grant Mail rules you did not create
THAT LAST ONE
A strong indicator of email compromise.
WHERE TO SEE THIS
Most services provide account activity or security pages.
Check them.
WHAT TO ENABLE
Notifications for logins and security changes.
WHERE TO SEND THEM
An address you monitor, and not only one hosted on the affected system.
WHAT TO DO ABOUT A SUSPICIOUS LOGIN
Change the password Review active sessions and end them Check what was done Check for added accounts or rules
HOW OFTEN TO CHECK
Monthly for critical accounts.
