Identify the signs of a possible breach: This could be unscheduled data feeds, external code (such as virus, Trojans, worms), code injection (SQL injection), unusually frequent activity indicating penetration attempts (distributed denial of service), access log-on failures (indicating potential attack attempts), unauthorized log-on, large file downloads outside of normal procedures, record inaccuracies indicating data corruption or missing information from a work file.