A cybersecurity analyst at a manufacturing company is tasked with analyzing the Indicators of Compromise...

An unknown IP address successfully logging in viaSSHindicates that authentication was achieved — likely due toweak or reused passwords. This is not enumeration or vulnerability exploitation, but acredential-based compromise.

NIST SP 800-118 (Guide to Enterprise Password Management):

“Weak, default, or reused passwords are among the most exploited vulnerabilities in enterprise networks, particularly on remote access services such as SSH.”

This is one of the most common findings inSIEM alertswhen password policies and access control mechanisms are improperly enforced.

????WGU Course Alignment:

Domain:System Security Engineering

Topic:Implement strong authentication practices and monitor remote access