In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff.

What do you think I need to write down in my report?
Is there any available template from a CIRT or another organization that can be used after an incident?
What is the best practice about this kind of report?

In my first analysis i found where the attack was planned (an IRC channel).
I found information about the tool used and the url where the tool can be downloaded.
The attack is made with a LOIC and not with any kind of botnet (as I actually know).
The attack was planned without a hierarchical organization but was organized and maded with the help of people recruited hand-to-hand with the sharing of a little manifesto and the sharing through IRC and twitter of a JPG containing the information on the target and the time of the attack.
I need also to write down some stuff about the people around this attack?

any suggestion?

PLEASE: one-suggestion one-answer, so we can have a community best practice at the end :)

  • I think a useful field would be total down time and also cost estimates of missed orders and repair costs.
    – user8161
    Mar 2, 2012 at 0:17

1 Answer 1


Sorry not to have a good link, but my thought is you want to cover:

What happened?

  • When did it happen, and for how long did it continue?
  • Who did it and how?
  • What was affected - what sites, what servers, how many servers, what part of the business? What customers?
  • Root Cause Analysis

What was the impact?

  • Damage to servers
  • Damage/exposure of information
  • Damage to corporate reputation
  • Damage to human life (crossing fingers that this is a definite no!!!)
  • Cost of Recovery (Time, Equipment, etc.)


  • What has been done so far? Break it down into immediate response vs. ongoing updates
  • What else should be done?
  • What is the projection for this happening again?
  • What about something like this, but not exactly the same?
  • Are there any changes we could make to future process to prevent/mitigate this type of risk?

Break into past/present/future - what did we do immediate, what are we doing now, what are the big things we should do in the future that will require high level funding?

Future Prognosis

  • If we do everything in the report what is the likely state of the system to future attacks. Probably not "bulletproof", so give some assessment of likelihood.
  • How about if we just leave the system in it's current (partially fixed?) state?
  • 2
    +1, I would also add root cause analysis, and also under impact - time personnel spent cleaning up the mess...
    – AviD
    Mar 9, 2011 at 9:37
  • @Avid - Thanks, good call, I made the update in the answer. Mar 9, 2011 at 18:38
  • well, then, I'd +1 you again, if I could... ;-)
    – AviD
    Mar 9, 2011 at 18:40
  • @Autocracy karma comes around
    – AviD
    Mar 9, 2011 at 18:51
  • @bethlakshmi: thanks for the good answer. Right now I found a guidelines from NIST about incident response after DDOS. An answer from myself come soon, i hope.
    – boos
    Mar 10, 2011 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.