Detecting Attacks on Data

AP Cybersecurity · Securing Applications and Data

Detecting Attacks on Data

Unusual access, a file nobody should touch, and a digest that changed.

key ideaThree signals: unusual access, a file nobody should touch, and a digest that changed.

What to look for

Data attacks are hard to see because most of them use permissions the adversary legitimately holds. What gives them away is not the act but the pattern: the wrong file, at the wrong time, from the wrong place — or a file that changed when it should not have.

Signal	What it is	What it catches
unusual access	accessing files that are not typically accessed	an account reaching outside its normal work
	access outside a user's normal patterns — time of day, location, device type	a compromised credential used by someone else
	attempts to delete or copy data	exfiltration and destruction
honeypot	a file that appears to contain valuable data — card details, PII, passwords — but whose contents are fake	anyone hunting for valuable data; the system alerts on access
cryptographic hash	a digest that reveals whether data have been altered	unexpected change to a file — a sign of malicious activity

The honeypot is the only one with no false positives by construction: nobody has a legitimate reason to open a file that exists solely to be bait.

the three signals

Access outside a user’s normal patterns counts — time of day, location and device type are all part of the pattern.
A honeypot is a file of fake data that looks valuable; the system alerts if anyone tries to access it.
Hashes are repeatable, so a changed digest means the file changed.
Attempts to delete or copy data are themselves indicators, whether or not they succeed.

Reading the evidence

Behaviorwho and when

Honeypotintent — nobody needs that file

Hashalteration, and nothing else

The three are complementary. Behavior catches who and when, the honeypot catches intent, and the hash catches alteration — and only the hash notices a change made by someone entitled to make it.

one morning on a file serverbehavior, honeypot and hash signals interleaved

09:14  READ    \\fs01\finance\q3-forecast.xlsx   user=r.adeyemi   (routine)
09:31  READ    \\fs01\hr\salaries-2026.xlsx        user=r.adeyemi   (first ever)
09:33  COPY    \\fs01\hr\*                          user=r.adeyemi   dest=E:\
09:34  READ    \\fs01\hr\_archive\card-data.xlsx    user=r.adeyemi   ** HONEYPOT **
09:34  ALERT   honeypot accessed                      user=r.adeyemi
02:11  HASH    \\fs01\config\payroll.cfg            digest changed since last check

09:14routine — this user reads finance forecasts every day09:31 first evera file not typically accessed by this account09:33 COPYan attempt to copy a directory to removable media09:34 HONEYPOTa file of fake card data, opened — nobody has a legitimate reason02:11 HASHa configuration file's digest changed overnight, unexpectedly

Worked analysis

EX 1

Read the sequence

Using the log above, describe what the first four lines together suggest.

Line 1

Routine — establishes what normal looks like for this account.

Line 2

A file not typically accessed by this user — the first departure from pattern.

Line 3

An attempt to copy data to removable media — consistent with exfiltration.

Line 4

A honeypot opened. It contains only fake data, and no legitimate workflow touches it.

State the conclusion

Together they describe an account searching for valuable data and removing it — and the honeypot converts a suspicion into an alert.

EX 2

Design a honeypot

An organization wants early warning that someone is hunting through its file shares. Design the control.

Make it look valuable

Name and place it so it appears to contain valuable data — card information, PII, passwords.

Ensure the contents are fake

The data in the file are fake, so nothing is lost if it is taken.

Ensure nobody needs it

No workflow, report or person should ever open it — that is what makes access unambiguous.

Wire the alert

The system alerts defenders if someone attempts to access it.

State why it is so effective

Near-zero false positives, and it costs almost nothing to deploy.

EX 3

What a hash does and does not catch

A hash check reports that a file's digest is unchanged. What has that ruled out, and what has it not?

State what it rules out

That the file has been altered — hashes are repeatable, so an unchanged digest means unchanged content.

State what it does not rule out

That the file was read, copied, or stolen — none of which changes the content.

Name the gap

A hash addresses integrity, not confidentiality.

Give the complementary control

Access logging and a honeypot — both notice reading, which a hash never will.

State the framing

An unchanged hash is evidence about the file, not about who has seen it.

Check yourself

What behavioral indicators suggest an attack on data?

Show answer

Accessing files that are not typically accessed; access outside a user’s normal patterns of time of day, location and device type; and attempts to delete or copy data.

What is a honeypot?

Show answer

A file that appears to contain valuable data — credit card information, PII, passwords — but whose contents are fake. The system can alert defenders if someone attempts to access it.

How do cryptographic hashes help detect attacks on data?

Show answer

They generate a digest that reveals whether data have been altered. A file that has changed unexpectedly can be a sign of malicious activity.

Why are honeypots unusually reliable indicators?

Show answer

Because nobody has a legitimate reason to open one. The file exists only as bait, so access to it is close to unambiguous.

Course map. Topic 5.6.a · LO 5.6.A — explain how to detect attacks on data (EK 5.6.A.1–5.6.A.3: accessing files not typically accessed, access outside normal patterns of time, location and device type, and attempts to delete or copy data; honeypots containing fake data that alert on access; cryptographic hash functions generating digests that reveal alteration).