After being hacked companies often give numbers and details on how much of their data was compromised e.g "13K user and passwords".
After a possible intrusion how do you know what the hacker did in your server?
4
-
2Might be better at security.SE– TheLQJul 7, 2011 at 17:59
-
TheLQ i had no idea that one existed– amosriveraJul 7, 2011 at 18:00
-
Just for future reference, thats all– TheLQJul 7, 2011 at 18:03
-
4This question appears to be off-topic because it is a question best asked on Security.SE, but is too old to migrate.– user40980Aug 11, 2014 at 2:58
Add a comment
|
3 Answers
Security Stack Exchange has a range of Questions and Answers in this area - you should have a look.
While post-incident forensics is quite a mature field, and I have managed a number of these, it is high cost, and most organisations take the sensible view of assuming worst case - the attacker could have accessed everything. A usual tack is to wipe machines and revert to a backup taken before the incident - but this can be very expensive in a large enterprise.
In terms of likelihood of identifying activities, if you are logging at the perimeter you can often find out how the attacker got in, but after that point, if they set up an SSH server or other encrypted channel into your network you will lose the detail after that.
For individual servers, you may have logs which can be trawled through (very time consuming) but if the attacker got root on these machines they could alter the logs to hide any evidence - which is why it is always recommended to log to a machine elsewhere which has a write once, read many filesystem (which means anything written there can never be deleted)
Layers of security do help in not only preventing intrusion, but in detecting it before it becomes a 'lift off and nuke from orbit' scenario.
As an interesting aside - many times when running a forensic analysis after an incident, teams find evidence of other, longer-term, well-hidden intrusions...worried, anyone?
Assume a worst case scenario. Examine your logs, figure out everything they might have gotten access to, and assume they took a copy of all of it.
answered Jul 7, 2011 at 16:53
Hopefully their activity is logged and you can analyze what they have done. Otherwise, without any sort of trace of their activity, it's hard to determine what could have been done. I would always assume the worst, but hope for the best. Usually companies report the worst case intrusion to alert their customers to what may have been compromised.
