The art of responding to incidents in an organized and thoughtful manner.

learn more… | top users | synonyms (2)

15
votes
1answer
1k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
7
votes
3answers
1k views

What does a court need to successfully prosecute a hacker? Please cite previous cases if possible

Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that: Integrity of the investigation is maintained The ...
7
votes
2answers
152 views

“Fingerprinting” and human error

Pretend for a moment I am investigating an attack. I find errors in the attack method (mistakes made by the human attacking my network/computer). I compile a database of these "mistakes" treating ...
6
votes
3answers
176 views

What policies maximize incident detection (and compromise detection)?

What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?
19
votes
10answers
1k views

Is it ever appropriate to fight back?

When an website or system is being attacked, is there ever a scenario where it should automatically take action against the attackers rather than just passively handling the attack? If so, what ...
9
votes
7answers
2k views

If I suspect my server is compromised then should I disconnect it immediately or not? From Power or Network?

According to Mandiant, you should not: Mistake #1: Immediately entering “remediaton mode” – also known as playing “Whack-A-Mole” ... as described here: http://blog.mandiant.com/archives/1525 ...