False positive

4.1 Map the provided events to source technologies

📘Cisco Certified CyberOps Associate (200-201 CBROPS)

---

Definition

A false positive in cybersecurity happens when a security system flags something as malicious or suspicious, but in reality, it is safe and normal.

Think of it as a “false alarm.” The system thinks there is a problem, but there isn’t one.

---

Why False Positives Happen

False positives happen because security tools need to detect threats based on patterns or rules. Sometimes, legitimate activity looks similar to malicious activity, so the system raises an alert.

Examples in IT environments:

1. Antivirus / Endpoint Protection
   • A file or program is flagged as malware, but it’s actually a safe company software update.
   • The antivirus thinks it’s suspicious because it has some similar behavior to malware, like modifying system files temporarily.
2. Intrusion Detection System (IDS) / Intrusion Prevention System (IPS)
   • IDS triggers an alert for “possible SQL injection,” but the traffic is actually a normal query from a database admin.
   • The system sees unusual characters in a URL and mistakenly thinks it’s an attack.
3. Firewall / Web Application Firewall (WAF)
   • A firewall blocks traffic because it looks like a port scan, but it’s actually a scheduled vulnerability scan by your IT team.
4. SIEM (Security Information and Event Management)
   • SIEM correlates multiple events and flags a “possible attack.” But after investigation, all events are normal operational activities (like backup scripts running at night).

---

Impact of False Positives

While a single false positive may seem harmless, many false positives can cause real problems:

1. Wasted Time
   • Security analysts spend time investigating alerts that are not real threats.
   • Example: Spending 30 minutes checking a log that turned out to be a harmless automated script.
2. Alert Fatigue
   • Too many false positives can make analysts ignore alerts, potentially missing real attacks.
3. Operational Disruption
   • Overly aggressive false positives can block legitimate users or applications, affecting business operations.

---

How to Identify a False Positive

1. Review the alert details
   • Check the logs carefully.
   • Does the activity match normal operations or user behavior?
2. Compare with baseline activity
   • Every network or system has normal patterns. If the activity is normal, it’s likely a false positive.
3. Check the source
   • Who or what generated the traffic?
   • Example: Is it a trusted server running a scheduled task?
4. Confirm with multiple tools
   • Use antivirus, SIEM, or NetFlow data to see if multiple sources detect the same activity.
   • If only one tool flags it, it may be a false positive.

---

Reducing False Positives

To make security tools more effective and reduce unnecessary alerts:

1. Tune detection rules
   • Adjust IDS, IPS, antivirus, or firewall rules to avoid flagging normal activities.
2. Whitelist trusted processes or IPs
   • Mark safe programs, services, or servers as trusted so they aren’t flagged repeatedly.
3. Regularly update tools
   • Security tools need updated definitions and rules to correctly distinguish between normal and malicious activity.
4. Use contextual data
   • Look at user behavior, device type, location, and time to help distinguish legitimate from malicious activity.

---

Example Scenario

Imagine a corporate network:

• A database backup runs every night at 2 AM.
• The IDS sees many rapid database queries at 2 AM and triggers an alert: “Potential SQL injection attack.”
• After investigation, the security analyst confirms it’s the nightly backup. ✅
• This is a false positive because the system flagged normal activity as malicious.

---

Exam Tips

1. Remember: False positive = alert, but no real threat.
2. Common sources in CBROPS: antivirus, IDS/IPS, firewall, WAF, SIEM.
3. Be able to distinguish between:
   • False Positive: Alert, no real threat.
   • False Negative: No alert, but there is a real threat (opposite problem).

---

This section is about understanding why alerts might be incorrect and how to handle them in a professional IT environment without wasting time or blocking legitimate operations.