tailieunhanh - Incident Response

Your router has been hacked. Now what? This chapter covers the basics of emergency response when dealing with a router compromise. Ideally, you should have an incident response plan that is tailored to your organization. If you are reading this chapter because you have just been hacked and don’t know what to do, first promise that as soon as this incident is over, you will develop a complete incident response plan. Then keep reading for help on responding to incidents involving router compromises | Page 143 Friday February 15 2002 2 52 PM APPENDIX C Incident Response Your router has been hacked. Now what This chapter covers the basics of emergency response when dealing with a router compromise. Ideally you should have an incident response plan that is tailored to your organization. If you are reading this chapter because you have just been hacked and don t know what to do first promise that as soon as this incident is over you will develop a complete incident response plan. Then keep reading for help on responding to incidents involving router compromises. The goals of incident response are to Determine if the incident is an attack or an accident Discover what happened and the scope of the incident Preserve all the evidence Recover from the incident Take the steps necessary to prevent this incident from happening again Warning If you do not have a detailed incident response plan in place and you have been hacked it is best to do nothing yourself and to call law enforcement. They are trained to preserve the evidence and investigate the incident and can track down attackers through means you don t have access to. Therefore the first recommendation is to do nothing and call law enforcement. However many attacks may look like accidental outages and vice versa . The following information is provided for those who are still trying to determine if an incident is due to a hacker or an accident or for those who must get the compromised router operational as soon as possible. So please read this entire chapter especially the section on preserving evidence to collect enough evidence to provide law enforcement with leads if necessary. When you reconfigure or reboot the router you 143 Page 144 Friday February 15 2002 2 52 PM destroy the original evidence so how you make copies of this evidence is extremely important to having any chance of holding up in a court of law. Keys to Investigating Your mission while investigating an incident is to 1. .

• Quản trị mạng
• công nghệ thông tin
• tin học
• quản trị mạng
• hệ điều hành
• cisco
• Dự thảo về Công nghệ thông tin
• Phát triển Công nghệ thông tin
• Ngành công nghiệp công nghệ thông tin
• Mục tiêu phát triển công nghệ thông tin
• Luật công nghệ thông tin
• Quản trị dự án công nghệ thông tin
• Ý tưởng dự án công nghệ thông tin
• Hoạch đinh chiến lược
• Tổ chức dự án
• Quản trị dự án công nghệ thông tin
• Lập kế hoạch dự án
• Quy trình quản lý dự án
• Ứng dụng công nghệ thông tin
• Công nghệ thông tin trong dạy tin học
• Thiết kế bài giảng điện tử
• Kỹ thuật chèn hình
• Kỹ thuật tạo hiệu ứng
• Cách làm slide thuyết trình
• Hiệu ứng Powerpoint
• mạng
• internet
• web
• quản trị mạngcông nghệ thông tin