Security Strategies in Linux Platforms and Applications, 3rd Edition

Monitoring Account Behavior for Security Issues

On a corporate network, you may need to look for signs of inappropriate behavior in user home directories. If a user has downloaded source code on his or her system, that user may have already compiled that code into a binary program of some sort. In that case, there will be files somewhere in the tree of the user’s home directory with executable privileges. Of course, such checks are subject to organizational policies. In general, it’s best if users know about such checks before they are performed so they are aware of the expectations with respect to their behavior. Note, too, that such checks may not be reasonable if users are in fact Linux developers or testers.

Downloaded Packages and Source ...