Intrusion Analysis

One of the authors of our text claims that You should investigate any and all unusual activity at regular times on given days, heavy system use (possible denial of service (DoS) attack) or CPU use (brute-force password-cracking attempts). Comment on this as a business strategy from the perspective of both cost and efficacy. Include all references.