we have switched network (SG300 cisco) connected using fiber optic(SFP), how can we detect any abnormal external behavior (such as tapping, physical attack, cutting, detecting connected optical splitter...) in order to protect our optical communication network?
Didn't realize it's possible to tap a fiber link without breaking connectivity, as mentioned by Tom. However, I would assume some tapping might create a temporary break in connectivity, which might be detected and logged.
Also, possibly, a tap might impact dB level across link. I.e. a sudden drop might be detected.
However, also like Tom, if someone tapping into your links is a concern, I too would recommend transit traffic be encrypted.