APLawrence.com -  Resources for Unix and Linux Systems, Bloggers and the self-employed

Incident Response

© November 2005 Michael Desrosiers

By Michael Desrosiers
m3ip, Inc.

This month's topic is incident response in regards to a security or privacy breach or compromise.

The first thing that an organization needs to understand is exactly what constitutes an incident, what incidents are reportable and what actions you need to take when an incident occurs. The purpose of an incident response plan is to respond, investigate and report any abnormal activities that deviate from approved or expected practices on your organization's information system resources. A solid business plan should include a description of a security violation, a security incident and an example of when a technical vulnerability causes or could cause one or the other.

There are two types of security violations:

Compliance laws and regulations(HIPAA, SOX, GLBA);
Organizational policies and procedures.

Security incidents may reveal the need for increased computer security efforts, possibly including a security training and awareness program. Technical vulnerabilities can be found in hardware, firmware or software and can be caused by design or implementation characteristics or flaws that leave an information system open to potential exploitation and escalation of risk to a business. Should you shut down the systems, alerting the potential hacker or should you try to gain more information about the attacker for prosecution or study? Your decision will depend on what sort of activity has already been discovered and what the likelihood is of loss of life or market edge. Timely reporting is paramount and should be consistent with the incident's severity. Efficient incident handling also will minimize the potential for negative public relations exposure. When an attack is in progress, spontaneous decisions can thwart efforts to determine the source of the incident, collect evidence or prepare for recovering the system and protect system data. Be aware that if you report a potential crime, authorities may seize all of your equipment and remove it from your premises for an unknown amount of time.

Planning & preparation:

Classification & identification:

Handling the incident;

Administrative actions:

There you have it. The premise behind developing a sound and workable incident response mechanism, is to think it through before it is needed. This is one aspect of information security that cannot be reactive.

To respond to this or previous newsletters or to inquire about an on-site presentation, please feel free to call us at 508-995-4933 or email us at mdesrosiers@m3ipinc.com.


Michael Desrosiers
m3ip, Inc.
We Manage Risk So You Can Manage Business

Got something to add? Send me email.

(OLDER)    <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

-> Incident Response


Inexpensive and informative Apple related e-books:

Take Control of Parallels Desktop 12

iOS 8: A Take Control Crash Course

Are Your Bits Flipped?

Photos: A Take Control Crash Course

iOS 10: A Take Control Crash Course

More Articles by © Michael Desrosiers

Fri Dec 16 16:05:21 2005: 1442   bruceg

I have a system at home, that was used this AM as a spamming bot. I was running an old version of a live help PHP program, that the spammers used to run perl commands on my machine as the apache user. The people who did this are in Brazil, so what can I do? I have a log of their IP addresses, etc, and also archived all the tools they were using to gain privaleges on my system.

Also, they have a "home" base that they are using that includes many of the files they transfer to your machine to perform the spamming. Have a look here:


What can I really do about this? Obviously, I plugged up the hole, and no rootkit detectors picked anything up. I am planning a fresh install, and reinstalled my apache, and php just in case they were changed. I do not have time to do the fresh install now, so I will heavily monitor that server, until I can. It is not a very important server, mostly dev stuff, so this was not a huge deal, but it does leave me with some questions about how I can report this to the owner of the IP that launched the attack. I do not speak Spanish, so that is another barrier for me.

I think it is safe to say that a lot of the security attacks in the computer world come from other countries outside the US, so what can really be done to stop it?

- Bruce

Fri Dec 16 19:38:28 2005: 1443   TonyLawrence

If you are certain that no legitimate use originates outside of the u.s., completely block all those addresses. It's harsh, but it will eliminate some attacks.


Printer Friendly Version

Have you tried Searching this site?

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us

Printer Friendly Version

Talent does what it can; genius does what it must. (Edward G. Bulwer-Lytton)

Linux posts

Troubleshooting posts

This post tagged:


Unix/Linux Consultants

Skills Tests

Unix/Linux Book Reviews

My Unix/Linux Troubleshooting Book

This site runs on Linode