You are an information security analyst at a large pharmaceutical company. While performing a routine review of audit logs, you have noticed a significant amount of egress traffic to various IP addresses on destination port 22 during off-peak hours. You researched some of the IP addresses and found that many of them are in Eastern Europe. What is the most likely cause of this traffic?
Significant egress traffic to various IP addresses on destination port 22 during off-peak hours, particularly to locations in Eastern Europe, strongly suggests that data is being exfiltrated. Port 22 is typically used for SSH (Secure Shell) or SFTP (Secure File Transfer Protocol), both of which are secure methods for transferring data. The fact that this traffic is occurring during off-peak hours and to potentially suspicious IP addresses increases the likelihood of data exfiltration by an advanced persistent threat (APT). Therefore, the most likely cause of this traffic is an APT exfiltrating data.
B. Data is being exfiltrated by an advanced persistent threat (APT)
correct
Likely B, egress traffic suggests exfiltration rather than incoming downloads.
Option C is a possibility, but the use of port 22 (which is commonly associated with SSH) connections) suggests that the egress traffic could be the result of data exfiltration by an advanced persistent threat (APT) or unauthorized access. Thus, option B (Data is being exfiltrated by an advanced persistent threat (APT))
Data egress refers to the process of sending data out...
Keyword is "egress", which means "to go" or to "come out". Yes SFTP runs on port 22 (choice C) but choice C is downloading or "coming in". B is the only valid case. I will 'egress' to my parents soon.