From time to time systems are compromised because one vulnerability is overlooked. An entire section is devoted to handling events such as break-ins, DoS attacks, and computer security law. Events that look like system intrusion may actually be software configuration errors. If an intrusion is suspected, react quickly by terminating the network connection. Next, document all that you observed, and any actions taken to restore the system.
Documentation can prove to be a valuable tool when trying to determine which backups to restore.
Finally, plan ahead for the next network intrusion by identifying the problem, determining the damage caused, restoring the system, and reporting the incident to the proper authorities. Unexplained reboots, significant hard drive activity, system crashes, and sluggish network connections may all be signs of an intruder. They can assist in tracking down the criminal. If handled properly, system damage can be minimized when a network intrusion is discovered. The author, Ramon J. Hontanon, explores incident response, reading intruders' tracks, ways to avoid intrusion, and information warfare.