The art of responding to incidents in an organized and thoughtful manner.

learn more… | top users | synonyms (2)

5
votes
1answer
221 views

xml library vulnerabilities, regarding post-exploitation

there was some arbitrary code execution that occurred on my os x 10.5 system. this came as a result of opening an xls file with excel for mac. the vnc type program that came with office for mac was ...
8
votes
4answers
449 views

Next steps after webmail account was compromised

John Doe told me the following story: I got a mail from a good friend. It just contained a single link. That seemed odd but I didn't think a lot about it. After clicking on the link, the web site ...
6
votes
5answers
614 views

Effect of Source Code Leakage of a security suite on security

I am interested to know what threats does it pose, if the source code of a security suite is leaked. It came to my mind after reading the following URLs: ...
3
votes
2answers
432 views

Legal process for suing joejobber?

I'm currently being joejobbed, and want to sue the joejobber. Details: I have real damages: the joejob causes me to receive fake bounces, which: stop/delay my receipt of legitimate mail, since ...
14
votes
4answers
436 views

What should I look at in the event of a major vendor suffering compromise with unspecified impact?

The specific example I have in mind here is the breach of RSA in March 2011 where attackers got away with critical information which could be the seed information which is used to generate the ...
6
votes
1answer
6k views

High concentration of UDP traffic, good or bad?

Should a network have a high concentration of UDP traffic compared to TCP traffic bad for a network especially in the context of network security? I'm looking at my organization's network protocol ...
6
votes
2answers
649 views

Is this a good way to manage Incident-Response

I m trying to find a good way to deal with incidents. For now these are my thoughts: x Join Logs and analyse with splunk (and alert with rsyslog, splunk is too expensive), x ...
12
votes
1answer
1k views

How to make a report after a ddos attack? what information do I need to write on the report?

In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff. What do you think I need to write down in my report? Is there any ...
8
votes
2answers
502 views

Mature CIRTs gather intel on their attackers. What sources & methods are used for this?

I copied this question verbatim from a tweet by Dave Hull. CIRT = Computer Incident Response Team
8
votes
4answers
1k views

How to track a laptop after theft?

Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible. ...
0
votes
1answer
450 views

IR Jump Bag - What kind of bag/container to use?

I am working on putting together an Incident Response Jump Bag (detailed here). Any suggestions on what type of container/bag to use for this? It seems like a lot of little items that could be ...
7
votes
4answers
291 views

Security papers or material focusing on the industrial control systems (SCADA)

Anyone know a good site or a list of resource to start to know issue related to the security of SCADA system ?
13
votes
2answers
323 views

Establishing routines on what to do if a PC gets stolen

I need to establish routines for how to handle theft of PC equipment, specifically laptops and stationary machines. Also I need to figure out how to make the consequences of stolen equipment minimal. ...
15
votes
1answer
2k views

What should be included in a jump bag and how often should it be reviewed?

What items should be included in a jump bag? How often do you review your jump bag?
7
votes
3answers
1k views

What does a court need to successfully prosecute a hacker? Please cite previous cases if possible

Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that: Integrity of the investigation is maintained The ...
7
votes
2answers
158 views

“Fingerprinting” and human error

Pretend for a moment I am investigating an attack. I find errors in the attack method (mistakes made by the human attacking my network/computer). I compile a database of these "mistakes" treating ...
6
votes
3answers
180 views

What policies maximize incident detection (and compromise detection)?

What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?
20
votes
10answers
1k views

Is it ever appropriate to fight back?

When an website or system is being attacked, is there ever a scenario where it should automatically take action against the attackers rather than just passively handling the attack? If so, what ...
9
votes
7answers
2k views

If I suspect my server is compromised then should I disconnect it immediately or not? From Power or Network?

According to Mandiant, you should not: Mistake #1: Immediately entering “remediaton mode” – also known as playing “Whack-A-Mole” ... as described here: http://blog.mandiant.com/archives/1525 ...