Incident Response

Foreword

In the beginning, before the first official emergency response team was founded, system administrators routinely handled computer intrusions and security problems. In November 1998, after the Morris Worm, several of us founded the Computer Emergency Response Team/Coordination Center (CERT/CC) in Pittsburgh, PA. Although I departed CERT/CC in 1996, I still have a lot of respect for the organization. While CERT/CC has played an important part in helping to make the Internet more secure, it really was the time and effort of the system administrators who reported incidents and product vulnerabilities to us at the CERT/CC that made the difference. It was not unusual for these dedicated system administrators to spend long days sifting through log files and file systems looking for clues to explain what happened to their systems and to identify other systems on the Internet that had been broken into. Their combined effort is why the words “Coordination Center” are part of the organization’s name.

When CERT/CC began in 1988, security was not on the top of most system administrators’ list of things to worry about. The culture at that time was to have a guest account on your system without a password. If you had any concern about the guest account, you might add a password. The most commonly used password was guest. Of course, everyone knew to try this password. Some of our earliest incidents involved intruders logging into the site’s guest account, exploiting known vulnerabilities, ...