Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff.

What do you think I need to write down in my report?
Is there any available template from a CIRT or another organization that can be used after an incident?
What is the best practice about this kind of report?

In my first analysis i found where the attack was planned (an IRC channel).
I found information about the tool used and the url where the tool can be downloaded.
The attack is made with a LOIC and not with any kind of botnet (as I actually know).
The attack was planned without a hierarchical organization but was organized and maded with the help of people recruited hand-to-hand with the sharing of a little manifesto and the sharing through IRC and twitter of a JPG containing the information on the target and the time of the attack.
I need also to write down some stuff about the people around this attack?

any suggestion?

PLEASE: one-suggestion one-answer, so we can have a community best practice at the end :)

share|improve this question
    
I think a useful field would be total down time and also cost estimates of missed orders and repair costs. –  user8161 Mar 2 '12 at 0:17
add comment

1 Answer

up vote 18 down vote accepted

Sorry not to have a good link, but my thought is you want to cover:

What happened?

  • When did it happen, and for how long did it continue?
  • Who did it and how?
  • What was affected - what sites, what servers, how many servers, what part of the business? What customers?
  • Root Cause Analysis

What was the impact?

  • Damage to servers
  • Damage/exposure of information
  • Damage to corporate reputation
  • Damage to human life (crossing fingers that this is a definite no!!!)
  • Cost of Recovery (Time, Equipment, etc.)

Halting/Preventing

  • What has been done so far? Break it down into immediate response vs. ongoing updates
  • What else should be done?
  • What is the projection for this happening again?
  • What about something like this, but not exactly the same?
  • Are there any changes we could make to future process to prevent/mitigate this type of risk?

Break into past/present/future - what did we do immediate, what are we doing now, what are the big things we should do in the future that will require high level funding?

Future Prognosis

  • If we do everything in the report what is the likely state of the system to future attacks. Probably not "bulletproof", so give some assessment of likelihood.
  • How about if we just leave the system in it's current (partially fixed?) state?
share|improve this answer
1  
+1, I would also add root cause analysis, and also under impact - time personnel spent cleaning up the mess... –  AviD Mar 9 '11 at 9:37
    
@Avid - Thanks, good call, I made the update in the answer. –  bethlakshmi Mar 9 '11 at 18:38
    
well, then, I'd +1 you again, if I could... ;-) –  AviD Mar 9 '11 at 18:40
    
@Avid - awww... Thanks. :) –  bethlakshmi Mar 9 '11 at 18:43
    
+1 because AviD can't –  Jeff Ferland Mar 9 '11 at 18:50
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.