In movies hacking is depicted as a weird sort of game. When you detect someone attacking your server, you face them head on. To me, it sounds like your best bet would be to just shut down the server as soon as they're detected.

I know though, that if the attacker is going after more than just your runescape account, you probably shouldn't take down your entire server. If you're a hospital, I doubt you would want to cut off life support to save some dude's medical records. In this case, I would guess you could just boot your attacker off. If there are multiple though, or the attacker somehow protects himself from this, is a "head to head" a real thing? Could an attacker actually protect themselves from this?

I'm sure there's an "automated" defense, like just some program trying to boot them off, but would there be any case where a human would actually have to type things in to prevent damage?

  • You are confusing a lot of different things into one, making this a little unanswerable. "Active Defence" is a real thing, but not at all as you described it. I have no idea what you mean by "head to head". Humans typing things in to engage protection mechanisms is a real thing and a normal part of cybersecurity defense, but you don't really describe what you mean by this. – schroeder Apr 22 '19 at 15:13
  • I think a little Googling is in order: en.wikipedia.org/wiki/Active_defense – schroeder Apr 22 '19 at 15:14
  • @schroeder I think this question is answerable, even if OP has little clue about IT and jumbles things up. An answer would just explain that one (typically) doesn't "boot" someone off of a server like in movies since systems can't be trusted post-compromise. I don't think OP has the vocabulary to find answers on their own or judge search results for correctness. We can make plenty of sense of the question to help them and any other movie-educated people that end up here. They too get to vote on political parties that might propose different digital attack/defense laws. Especially with a name – Luc Apr 22 '19 at 16:29
  • like 'curious student', s/he does seem to want to learn. As for the close reason, I don't see how this is not about "protecting assets from threats", specifically the bullet point "incident response". It's subjective in the way that the 'avoid asking' FAQ page mentions: it invites a 'why' or 'how' answer, does not specifically ask for opinions, and is not 'mindless social fun'. It might be a 'stupid' question by some definitions, but it can be answered Q&A-style and seems on-topic. – Luc Apr 22 '19 at 16:29
  • 1
    Oh, I didn't realize you were waiting for a response. Hopefully the asker is smarter than me. (Although I honestly can't tell what part of your comment contains the question whose answer might clarify what currently makes it unclear (or off topic), unless it's about the head-to-head thing which seems minor.) – Luc Apr 22 '19 at 17:00