Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

Looking for a formula and parameters to feed it that will aid in the isolation of relationships within a system when the origin and cause of an exploit within it is unknown. Here's an example of an attack where the vector(s) are unknown, but there is an awareness of the exploit's occurrence: Verifying that I have fully removed a WordPress hack?

share|improve this question
3  
Can you expand further on what you mean by formula - I don't understand your question. Perhaps an example? – Rory Alsop♦ Jun 10 '11 at 23:48
@Rory Alsop: Well since I've already given an example, I'll stick to it. A wordpress site had HTML inserted into the homepage, there is ZERO trace of how it got there, how would you backtrack from that asset to it's access points to zones beyond control, including the possible conclusion that those zones maybe that source of the attack, and that there is no countermeasure for that threat zone; in thing case, the site's on a shared server, which is not 100% in control of the site itself. Just seems to me, basic problem is if there no logs, how to you traces vectors of the known exploits. – blunders Jun 11 '11 at 3:19
Example understood, but what do you mean by formula here? – AviD♦ Jun 11 '11 at 21:54
@Avid: A systematic approach with expected inputs and outputs, but any method is fine. – blunders Jun 11 '11 at 22:59

1 Answer

up vote 4 down vote accepted

If you have zero trace of what happened then you can only make assumptions as to what happened.

Standard practice is to identify all platforms and versions, then to look at vulnerability databases to see if there are known weaknesses in your environment.

Then look at all information flows and transforms - identifying entrance points.

The above are common initial steps in identifying vulnerabilities, but I don't understand what your question means regarding isolating relationships etc.

Hope this helps.

share|improve this answer
Nice work in providing concrete actions and standard practice. – this.josh Jun 11 '11 at 18:44
+1 @Rory Alsop: The intent of isolating relationships in to limit the scope of analysis to the attack. – blunders Jun 11 '11 at 23:10
So by isolating relationships you mean identifying information flows and connections? – Rory Alsop♦ Jun 12 '11 at 16:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.