Overnight logs show thousands of failed logons against the city's SSL-VPN used by public-works staff. How should the analyst classify this activity?
Select an answer to reveal the explanation.
Short Explanation
Somebody spent the night jiggling the public-works VPN doorknob—thousands of failed logons, no ransom note, no SQL payload. That is brute-force or password-spray on an exposed remote-access service. Call it what the logs show, not what might happen next week.
Full Explanation
Overnight logs showing thousands of failed logons against the city's SSL-VPN used by public-works staff should be classified as brute-force or password-spray against an exposed remote-access service. The evidence is authentication failure volume against a remote-access front door, not encryption, SQL payloads, or insider cloud uploads. Civic SOCs should name what the logs show tonight, not speculate about what might happen next week.
Calling it ransomware encryption of the public-works file share fails by concept: failed VPN logons are not encryption evidence. Calling it SQL injection against the permits API fails by concept: the target and pattern are VPN authentication, not API injection. Calling it insider exfiltration to a personal cloud drive fails by concept: mass failed logons against an exposed service are not insider cloud theft.
Exam caveat: Mass failed logons on exposed VPN or remote access approximate brute-force or password spray until proven otherwise.
Operational check: Confirm source diversity and username patterns to distinguish spray from stuffing, enable lockouts with MFA and geo controls, create or tune ES notables on VPN failure bursts, and check for any successful logons in the same window.