Incident Response

Chapter 5. State of the Hack

Using the firefighting analogy once again, a fire department needs to understand the situations that it is likely to encounter. For example, a simple brush fire can be quickly put out with water, but a chemical fire requires different firefighting equipment and supplies to extinguish. Likewise, as smoke detectors, sprinklers, and other fire detection and suppression methodologies became available, every fire department has to understand and promote those protection tools and methodologies. Sprinklers are now mandatory in most commercial buildings by order of the local Fire Marshall.

Although fire technology might not advance as quickly as computer security technology, it is nonetheless equally critical that every incident response team keep abreast of the State of the Hack.^[3] How are intruders breaking into systems? How are they being detected? How are systems administrators and other incident response teams handling these attacks? What works and what doesn’t? How do we know an attack is taking place? You need to gather intelligence and compare notes with others in the field to insure that you are constantly aware of these dynamic security issues.

During an incident in the early 1990s, a victim site alerted our team that intruders might have compromised the victim’s systems and were apparently “sniffing” usernames and passwords on the network, at least according to the site reporting the incident. While we knew that it was more than theoretically ...