New answers tagged

1

This is a difficult question. To write proper incident response procedures you will probably want to consult with someone who does this as their full time job. They will be able to guide you through the creation of procedures for your business, by taking into account your level of tolerable risk, assets (company name, etc.), legal/regulatory exposure, and ...


0

There is a strong chance that her device is infected with malicious software, this may be the result of visiting just a link that has been send to you. Try Lookout, A predictive security app which I use often and recommend to friends and clients. You can install the Android or iOS app to enable app scanning, it enables continuous, over-the-air protection ...


0

Like @SteffenUllrich said, it depends on a lot of factors. Do you have any IDS? Firewall? Is your network a small one or a big one? Anyway, even if a lot of elements are missing, here is some basics to have for a small network: - Isolate the computer that is compromised from the network Read the logs (keep in mind there may be logs missing/erase) and ...


1

"What steps do you take to feel confident..." Restore from back up. Now you said running as root so I will assume this is a Unix variant (Linux/BSD/etc) here are some things you can do to give you a baseline of what may be going on. 1) Take the machine offline if possible: mkdir /tmp/DFIR netstat -a | grep -i "tcp\|udp\|icmp" >> ...



Top 50 recent answers are included