Ransomware spread across hospital systems and no sensor raised an alert during the spread. How should that detection miss be classified?
Select an answer to reveal the explanation.
Short Explanation
A thief crossed the floor and every bell stayed quiet. Ransomware that spreads at your hospital with no sensor alert is a false negative. An alert on harmless activity, a correct alert, or permitted traffic would have left a different trace.
Full Explanation
A false negative is an attack that happened while detection stayed silent. Ransomware spread across the hospital systems, and no sensor raised an alert while it spread. The attack is real and the queue is empty, which is the miss. A false negative, meaning the ransomware spread and no sensor produced an alert at all. An alert on harmless activity is the other error. A false positive, meaning a sensor alert fired on hospital activity that was not an attack requires an alert, and this spread produced none. A correct detection also requires an alert. A true positive, meaning a sensor alert fired and correctly identified the ransomware spread would be the right classification only if a sensor had named the ransomware. None did. Allowed activity is the wrong label for the encryption event. Benign activity, meaning the ransomware execution was genuine traffic the hospital permits treats the spread as authorized. Ransomware encrypting hospital systems is not permitted activity, and the failure here is that detection missed it. Exam caveat: a false negative is invisible in the alert queue. Finding the damage later does not convert the miss into a successful detection, and an empty queue is not a clean result when hosts were actually encrypted. Operational check: search the intrusion, endpoint, and antivirus consoles for those hosts during the spread window, record the absence of alerts, and treat the gap as a detection miss.