An engineer notices that every Sunday night, there is a two-hour period with a large load of network activity. Upon further investigation, the engineer finds that the activity is from locations around the globe outside the organization’s service are a. What are the next steps the engineer must take?

The described activity is a significant anomaly that requires a methodical investigation. The correct next step is to follow a structured analysis process. This involves using network visibility tools like Cisco Secure Network Analytics (formerly StealthWatch) or a SIEM to identify the specific sources and destinations ("define the access points"). The engineer must then understand what services are running and accessible during that time frame to determine what is being targeted. Finally, cross-correlating this network data with other event sources (e.g., server logs, authentication logs) is crucial to build a complete picture and determine if the activity is malicious.

A. Escalating to a provider without any initial internal analysis is premature and demonstrates a lack of due diligence.
B. Blocking all traffic is a drastic and premature containment step that could cause an outage of legitimate services.
D. Treating a significant, recurring anomaly from unknown global sources as a false positive is negligent and a severe security risk.

1. Grance, T., Kent,K., & Kim, B. (August 2012). NIST Special Publication 800-61 Rev. 2: Computer Security Incident Handling Guide. Section 3.2.2, "Analysis." This section outlines the process of analyzing precursors and indicators, which involves correlating data from multiple sources to validate and understand an incident.

2. Cisco. (2023). Cisco Secure Network Analytics (Stealthwatch) At-a-Glance. This document describes how the tool provides network visibility to "See everything" and "Detect threats" by analyzing network traffic patterns and correlating events, which aligns directly with the steps in the correct answer.