My question follows recent news of the Sony hacking incident. I was wondering what type of investigation is conducted by a security firm or the FBI. For example, if the network servers were hacked, what is the first thing done? Do they shutdown all server networks, to stop any potential transmission. If the breach was caused by a malware, then how can they effectively contain it during their analysis? Using sandbox has its limitations, would they run all current data on a new physically separated machine, as well as a virtual machine?

I have a feeling this question might become too long to answer, but short steps will suffice and if possible links to more detailed processes, if available. Ultimately, the answer is finding the source of the hack, but what steps are done in the investigation leading up to the identification of the source of the hack.

1 Answer 1


This is largely dependent on the organisation's policies, but what you're talking about is Incident Response (IR), which falls under the umbrella term of Computer Security Incident Management.

The response that is taken usually depends on the type of attack, the known threat actors (if any), and the individual systems or network regions that are known to be compromised. These are important distinctions - you wouldn't take the same actions with a compromised receptionist's workstation as you would a compromised life support system or industrial control system.

The main steps in IR are:

  • Alert - Someone notifies the team that a potential breach has occurred.
  • Classification - A first level responder performs a preliminary analysis to identify the level of threat, and takes the prescribed IR steps for the class of threat (e.g. normal, critical, etc.)
  • Action - Isolation and cleanup of the affected systems, with steps taken to ensure any backdoors are closed and the original hole is patched.
  • Investigation - Identification of how the threat appeared, attribution of the attackers, etc.

You can then split these down and rearrange them as they pertain to a particular situation. In some cases, the organisation may be solely interested in recovering and continuing, so the investigation phase is minimal or even skipped. In other cases, legal process may be considered, so special care is taken to provide a strong chain of evidence using tools known to be approved by the local courts. Sometimes the action step doesn't involve cleaning the machine at all, in an attempt to log and monitor the behaviour of the attackers in realtime to gain stronger attribution.

In short: the answer is that it depends on the organisation and the situation. IR is rarely black-and-white.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .