Question
A security analyst is investigating a possible insider threat incident that involves the use of an unauthorized USB from a shared account to exfiltrate data. The event did not create an alert. The analyst has confirmed the USB hardware ID is not on the device allow list, but has not yet confirmed the owner of the USB device. Which of the following actions should the analyst take next?
- A. Classify the incident as a false positive.
- B. Classify the incident as a false negative. Correct
- C. Classify the incident as a true positive.
- D. Classify the incident as a true negative.
Explanation
Data was actually exfiltrated through an unauthorized USB device, yet no alert fired, so the detection control missed real malicious activity: that is a false negative. A false positive is an alert on benign activity, a true positive is an alert on real activity, and a true negative is correctly staying silent on benign activity. Confirming the device owner is a later investigative step and does not change the classification.
