|
Recovering From an Attack |
|
|
|
Source: securitypipeline.com - Posted by Vincenzo Ciaglia
|
No matter the size of your network, sooner or later you'll have to clean up an infected machine. Recovery from an attack can be daunting, but following some simple steps will make it less painful. . . .
No matter the size of your network, sooner or later you'll have to clean up an infected machine. Recovery from an attack can be daunting, but following some simple steps will make it less painful.
Breaches come in all shapes and sizes, from an intruder attacking one of your computers to a piece of spyware rerouting your Web traffic through its site to capture user names and passwords. Whatever the breach, you must act quickly.
Take heed of red flags. One sign of infiltration or worm infection is when your workstations or servers suddenly flood the network or operate abnormally. Another clue is when odd or nonremovable directories appear on your hard drive without your antivirus and antispyware tools detecting them.
We've had our share of intrusion recovery at the University of Wisconsin-Madison College of Engineering. Last month, MarketScore--spyware that appears to detour Web traffic to its own site so it can steal names and passwords--infiltrated one of our systems.
We had heard from other Big 10 colleges that this rogue code was circulating, so we checked our border traffic and found one infected user workstation. After making a forensic image of the system, we wiped the drive clean and reinstalled it. Fortunately, the damage was isolated to a single user, whose passwords at various Web sites may have been compromised.
Read this full article at securitypipeline.com
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
