Most of the time, when an intruder is detected, we would disconnect it at once. However there are certain cases where the intruder is not disconnected.

What are the benefits of not disconnecting the intruder? Can I say something like, some organizations would want to trace the intruder's identity and by not disconnecting the intruder, that is possible?

  • Could you define deeper the use of the word "intruder" in your case? – BrownEyes Oct 17 '13 at 12:55
  • Intruder as in a hacker/cracker. – Papple. Oct 17 '13 at 12:59
  • And what kind of intrusion are you talking about? I.e. be more specific – BrownEyes Oct 17 '13 at 13:01
  • Hmm..no specific kinda intrusions actually, just see it in general - An unauthorized intrusion on a computer system/network. – Papple. Oct 17 '13 at 13:12

Knowing of an attacker and not disconnecting them will allow you gather evidence on the attacker such as determining the motive for the attack, determining the tools the attacker is using, determining the mode of operation of the attacker and maybe... just maybe, but not likely, being able to trace the connection back to the attacker. You could then try to use attribution to determine likely suspects.

Doing this could have legal and reputation implications. Imagine what Fox news will say on the air when they found out you allowed the attacker to have access to your network, compromising the confidentiality of company data. In my opinion, unless the attacker is currently in a honeypot that you all have deliberately setup, it's best to just disconnect them and look at the evidence you currently have.

|improve this answer|||||
  • What kind of tools the attacker could use? – Papple. Oct 17 '13 at 13:32
  • Can one choose not to disconnect the intruder for some sort of studies/research purposes? Studying the behaviour and etc.? – Papple. Oct 17 '13 at 13:33
  • There's a ton of freely available hack tools out there. The way you would know what tools their using would be from your own experience of playing with different tools like are they nmap vs hping3 or both to scan your network, are they using netcat or telnet for connections, are they running common exploits found in metasploit etc... – Four_0h_Three Oct 17 '13 at 14:03
  • 3
    PCXQ - that is what Pseudo said. If you look at our questions on Honeynets and Honeypots you will find further information – Rory Alsop Oct 17 '13 at 14:04
  • To answer your second question, you don't want to do that on a production network.. ever. You'll have the CEO breathing down your neck and news reporters chasing you around for months :) If you want to track them for research setup a honeypot which is a non production system that has no sensitive data in it. It's designed to look enticing to an attacker so they attack it while you watch and log everything. Checkout en.wikipedia.org/wiki/Honeypot_(computing) – Four_0h_Three Oct 17 '13 at 14:06

One other consideration is that a disconnect clearly signals to the attacker that they have been spotted. They may then try a different approach from another IP address and see how far they get before being spotted.

If you have 24x7 ops it may make sense to automatically alert an operator to an attack, but make disconnecting the attacker a manual action.

|improve this answer|||||

It is generally preferable to disconnect the intruder then close down the internet connection to prevent them from coming back and causing more havoc in the network. Once this happens, you can go through the logs and determine how they gained access in the first place, what data was accessed, etc. Some very determined attackers will continuously attempt to gain access to a network. State sponsored intruders come to mind here.

  1. If they are not anywhere critical, then you may want to watch them to see what they are up to.
  2. However, if they are gaining or have gained access to private data such as customer information, then you will want to disconnect them quickly to mitigate any damage.
|improve this answer|||||

The answer depends on who you are, and what the attacker is accessing. If you're a home user afraid of losing your banking passwords or credit card numbers, yes, disconnect. If you're an internal corporate investigator trained in capturing forensic evidence, and the attacker is caught poking around your systems, you'll probably start by filing an incident and begin tracing their activity.

However, if the system the attacker is accessing contain databases of your customers' federally protected information (GLBA, HIPAA, FERPA, COPA, etc.) or their financial information covered by PCI regulations (credit card numbers, etc.), you should probably contact your local FBI office and ask for their computer crimes unit. In the absence of any other response plan, I would do this immediately while the crime is underway, but in any case you'll likely be required to report it to them within 24 hours of discovery. They should provide you with the appropriate response, which might include "do nothing for two hours while we send someone to investigate".

Most importantly, your response should be determined in advance and written into an info security policy in conjunction with your corporate attorney's advice. Maybe you'll decide to place an investigating firm on retainer, and use them as your first contact (in order to avoid bad publicity regarding contacting the FBI if they determine the attacker did not access the protected data.) But it's important to plan this in advance - if an attack happens at midnight, your admin's first response is likely not to call the attorney for advice.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.