chapter describes what to do if you discover that someone has broken
into your computer system: how to catch the intruder; how to figure
out what, if any, damage has been done; and how to repair the damage,
We hope that you'll never have to use the
techniques mentioned here.
There are three major rules for handling security breaches.
After a security breach, you are faced with many different
choices. No matter what has happened, you will only make things
worse if you act without thinking.
Before acting, you need to answer certain questions and keep
the answers firmly in mind:
Did you really have a breach of security?
Something that appears to be the action of an intruder might actually
be the result of human error or software failure.
Was any damage really done? With many security breaches,
the perpetrator gains unauthorized access but doesn't actually
access privileged information or maliciously change the contents
Is it important to obtain and protect evidence that
might be used in an investigation?
Is it important to get the system back into normal
operation as soon as possible?
Are you willing to take the chance that files have
been altered or removed? If not, how can you tell for sure if changes
have been made?
Does it matter if anyone within the organization
hears about this incident? If somebody outside hears about it?
Can it happen again?
The answers to many of these questions may be contradictory;
for example, protecting evidence and comparing files may not be
possible if the goal is to get the system back into normal operation
as soon as possible. You'll have to decide what's
best for your own site.
a log, immediately. Take a notebook and write down everything you
find, always noting the date and time. If you examine text files,
print copies and then sign and date the hardcopy. If you have the
necessary disk space, record your entire session with the script
command, too. Having this information on hand to study later may
save you considerable time and aggravation, especially if you need
to restore or change files quickly to bring the system back to normal.
This chapter and the two chapters that follow present a set
of guidelines for handling security breaches. In the following sections,
we describe the mechanisms you can use to help you detect a break-in,
and handle the question of what to do if you discover an intruder
on your system. In
Denial of Service Attacks and Solutions
describe denial of service attacks - ways in which attackers
can make your system unusable without actually destroying any information.
Computer Security and U.S. Law
, we'll discuss
legal approaches and considerations you may need to consider after
a security incident.
to effective response in an emergency is advance planning. When
a security problem occurs, there are some standard steps to be taken.
You should have these steps planned out in advance so there is little
confusion or hesitation when an incident occurs.
In larger installations, you may want to practice your plans.
For example, along with standard fire drills, you may want to have
"virus drills" to practice coping with the threat
of a virus, or "break-in drills." The following
basic steps should be at the heart of your plan:
Step 1: Identify and understand
If you don't know what the problem is,
you cannot take action against it. This rule does not mean that
you need to have perfect understanding, but you should understand
at least what
of problem you are dealing
with. Cutting your computer's network connection won't
help you if the problem is being caused by a revenge-bent employee
with a terminal in his office.
Step 2: Contain or stop the damage.
If you've identified the problem, take
immediate steps to halt or limit it. For instance, if you've
identified the employee who is deleting system files, you'll
want to turn off his account, and probably take disciplinary action
as well. Both are steps to limit the damage to your data and system.
Step 3: Confirm your diagnosis and determine
After you've taken steps to contain the
damage, confirm your diagnosis of the problem and determine the
damage it caused. Are files still disappearing after the employee
is discharged? You may never be 100% sure if two or more
incidents are actually related. Furthermore, you may not be able
to identify all of the damage immediately, if ever.
Step 4: Restore your system.
After you know the extent of the damage, you need
to restore the system and data to a consistent state. This may involve
reloading portions of the system from backups, or it may mean a
simple restart of the system. Before you proceed, be certain that
all of the programs you are going to use are "safe."
The attacker may have replaced your
program with a Trojan horse that deletes both the files on your
on your backup tape!
Step 5: Deal with the cause.
If the problem occurred because of some weakness
in your security or operational measures, you'll want to
make changes and repairs after your system has been restored to
a normal state. If the cause was a person making a mistake, you
will probably want to educate him or her to avoid a second occurrence
of the situation. If someone purposefully interfered with your operations,
you may wish to involve law enforcement authorities.
Step 6: Perform related recovery.
If what occurred was covered by insurance, you may
need to file claims. Rumor control, and perhaps even community relations,
will be required at the end of the incident to explain what happened,
what breaches occurred, and what measures were taken to resolve
the situation. This step is especially important with a large user
community, because unchecked rumors and fears can often damage your
operations more than the problem itself.