The art of responding to incidents in an organized and thoughtful manner.
7
votes
4answers
565 views
Gmail account hack prevention and recovery
I am doing a research on how to prevent my gmail account from being hacked and what are the options of claiming it back.
The associated phone number and recovery email can be changed, in fact I ...
3
votes
2answers
515 views
Found some malicious Javascript - how did it get there?
Found some malicious javascript on a Joomla site which we noticed has returned after being deleted a week ago. Also noticed that www.cssstickyfooter.com is infected by the same code. If you're ...
4
votes
1answer
177 views
xml library vulnerabilities, regarding post-exploitation
there was some arbitrary code execution that occurred on my os x 10.5 system.
this came as a result of opening an xls file with excel for mac.
the vnc type program that came with office for mac was ...
8
votes
4answers
291 views
Next steps after webmail account was compromised
John Doe told me the following story:
I got a mail from a good friend. It just contained a single link. That seemed odd but I didn't think a lot about it. After clicking on the link, the web site ...
5
votes
5answers
264 views
Effect of Source Code Leakage of a security suite on security
I am interested to know what threats does it pose, if the source code of a security suite is leaked. It came to my mind after reading the following URLs:
...
3
votes
2answers
241 views
Legal process for suing joejobber?
I'm currently being joejobbed, and want to sue the joejobber. Details:
I have real damages: the joejob causes me to receive fake bounces, which:
stop/delay my receipt of legitimate mail, since ...
13
votes
4answers
254 views
What should I look at in the event of a major vendor suffering compromise with unspecified impact?
The specific example I have in mind here is the breach of RSA in March 2011 where attackers got away with critical information which could be the seed information which is used to generate the ...
6
votes
1answer
2k views
High concentration of UDP traffic, good or bad?
Should a network have a high concentration of UDP traffic compared to TCP traffic bad for a network especially in the context of network security?
I'm looking at my organization's network protocol ...
5
votes
2answers
368 views
Is this a good way to manage Incident-Response
I m trying to find a good way to deal with incidents.
For now these are my thoughts:
x Join Logs and analyse with splunk (and alert with rsyslog, splunk is too expensive),
x ...
11
votes
1answer
713 views
How to make a report after a ddos attack? what information do I need to write on the report?
In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff.
What do you think I need to write down in my report?
Is there any ...
7
votes
2answers
396 views
Mature CIRTs gather intel on their attackers. What sources & methods are used for this?
I copied this question verbatim from a tweet by Dave Hull.
CIRT = Computer Incident Response Team
8
votes
4answers
502 views
How to track a laptop after theft?
Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible.
...
0
votes
1answer
257 views
IR Jump Bag - What kind of bag/container to use?
I am working on putting together an Incident Response Jump Bag (detailed here).
Any suggestions on what type of container/bag to use for this? It seems like a lot of little items that could be ...
7
votes
4answers
206 views
Security papers or material focusing on the industrial control systems (SCADA)
Anyone know a good site or a list of resource to start to know issue related to the security of SCADA system ?
12
votes
2answers
228 views
Establishing routines on what to do if a PC gets stolen
I need to establish routines for how to handle theft of PC equipment, specifically laptops and stationary machines. Also I need to figure out how to make the consequences of stolen equipment minimal.
...
11
votes
2answers
784 views
What should be included in a jump bag and how often should it be reviewed?
What items should be included in a jump bag? How often do you review your jump bag?
7
votes
3answers
726 views
What does a court need to successfully prosecute a hacker? Please cite previous cases if possible
Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that:
Integrity of the investigation is maintained
The ...
6
votes
2answers
123 views
“Fingerprinting” and human error
Pretend for a moment I am investigating an attack. I find errors in the attack method (mistakes made by the human attacking my network/computer). I compile a database of these "mistakes" treating ...
5
votes
3answers
134 views
What policies maximize incident detection (and compromise detection)?
What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?
17
votes
10answers
1k views
Is it ever appropriate to fight back?
When an website or system is being attacked, is there ever a scenario where it should automatically take action against the attackers rather than just passively handling the attack? If so, what ...
6
votes
7answers
551 views
If I suspect my server is compromised then should I disconnect it immediately or not? From Power or Network?
According to Mandiant, you should not:
Mistake #1: Immediately entering “remediaton mode” – also known as playing “Whack-A-Mole”
... as described here: http://blog.mandiant.com/archives/1525
...
