We have a web application server and a database on AWS.

Is there any "immediate action" policy somewhere we can adopt as to the steps we can take when we suspect or detect a data breach?

  • the regulations you are under will have an opinion - also data breach insurers will have very specific steps to take (if you are insured) - if you are looking for standard policies, you can simply look at what the insurance companies require – schroeder Jun 1 '15 at 16:28

There are books on this topic under the subject heading "cyber forensics".

Normally you will want to image all the memory of the computers involved and then the drives, so you can figure out what may have been taken. You also want to review and organize all your network logs. You also want to T-off any infected machines to capture the packet stream for surveillance reasons. This can be done at the switch or using specialized hardware like a basic SharkTap sniffer. It is advisable to get yourself set up to tap and copy ahead of time, so if you need to do it, there is no delay.

You also want to avoid tipping off the hackers that they have been noticed. Don't go around shutting things down, because then they will go and hide. You want to pretend like nothing has happened, so they keep doing stuff. If you can figure out how to watch them, you will be in a much better position to determine what may have been copied, and maybe even able to catch them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.