How to make a report after a ddos attack? what information do I need to write on the report?

Question

In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff.

What do you think I need to write down in my report?
Is there any available template from a CIRT or another organization that can be used after an incident?
What is the best practice about this kind of report?

In my first analysis i found where the attack was planned (an IRC channel).
I found information about the tool used and the url where the tool can be downloaded.
The attack is made with a LOIC and not with any kind of botnet (as I actually know).
The attack was planned without a hierarchical organization but was organized and maded with the help of people recruited hand-to-hand with the sharing of a little manifesto and the sharing through IRC and twitter of a JPG containing the information on the target and the time of the attack.
I need also to write down some stuff about the people around this attack?

any suggestion?

PLEASE: one-suggestion one-answer, so we can have a community best practice at the end :)

Answer 1

Sorry not to have a good link, but my thought is you want to cover:

What happened?

• When did it happen, and for how long did it continue?
• Who did it and how?
• What was affected - what sites, what servers, how many servers, what part of the business? What customers?
• Root Cause Analysis

What was the impact?

• Damage to servers
• Damage/exposure of information
• Damage to corporate reputation
• Damage to human life (crossing fingers that this is a definite no!!!)
• Cost of Recovery (Time, Equipment, etc.)

Halting/Preventing

• What has been done so far? Break it down into immediate response vs. ongoing updates
• What else should be done?
• What is the projection for this happening again?
• What about something like this, but not exactly the same?
• Are there any changes we could make to future process to prevent/mitigate this type of risk?

Break into past/present/future - what did we do immediate, what are we doing now, what are the big things we should do in the future that will require high level funding?

Future Prognosis

• If we do everything in the report what is the likely state of the system to future attacks. Probably not "bulletproof", so give some assessment of likelihood.
• How about if we just leave the system in it's current (partially fixed?) state?