Intrusion Detection FAQ: If I suspect a system is compromised what should I do?

More than 90 experienced incident handlers agreed on the following steps:

Remain calm; don't hurry.
Notify your organization's management.
Provide a game plan (with options if possible).
Apply need-to-know.
Use out-of-band communications; avoid email and other network-based communications channels.
Take good notes, good enough to serve as evidence in a court of law.
Contain the problem; pull the network cable.
Back up the system(s), and collect evidence.
Eradicate the problem and get back in business.
Lessons learned, apply what you have learned.

< Previous Question | Back to Intrusion Detection FAQ Home | Next Question >

Check Them Out!

SANS Security West 2013
Security Awareness Training
Top Cyber Security Risks
SANS Reading Room
Career Roadmap
Storm Center
WhatWorks™
Newsletters

It offers a strategic & practical approach to auditing which is not only informative, but inspiring... truly enabling.
-Steve Yuhas, TESSCO Technologies

Intrusion Detection FAQ: If I suspect a system is compromised what should I do?

Check Them Out!

Latest Whitepapers

Latest Tweets

Contact Us