During the day-to-day operations of an organisation, many failures and errors can occur, such as a sudden, dramatic increase in incoming logged data. If the employees responsible are not sufficiently aware or trained, they may not identify security-relevant events and thus allow an attack to remain unnoticed. Even if the employees are adequately aware of and trained in issues relating to information security, they may still fail to recognise security incidents. Consider the following examples:

• A user who has not logged on to the organisation's local network for a long time does not think it is abnormal that their laptop has been noticeably slower while accessing the Internet for a week. They do not notice that a malicious program is active in the background. The user was evidently not adequately trained to recognise suspicious activities and inform the Chief Information Security Officer accordingly.
• A production manager does not notice that data in both the production systems and control display systems has been changed in a covert manner. They do not suspect anything when the SCADA controller of a production system displays unusual values because this only happens for a short period of time. The incident is not reported because all the displayed values have returned to normal. As a consequence, no one notices that the display values were manipulated by malware.

• BSI -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)