The first step is to deploy an operations management system. By operations, we are talking about monitoring everything that happens in your environment. The system must also be able to apply intelligence to the information gathered to establish what is normal for your environment. It is then possible to detect deviations (or suspicious behaviours). For example, it would be possible to detect that it is in the habit of a user to connect to multiple workstations simultaneously, but that it may be suspicious if those connections are not all in the same country. In the same logic, a workstation might detect an abnormal connection if the user does not enter his or her username and password with the same typing speed as the user typically uses.