Microsoft® Windows® 2000 Security Handbook

Reacting to Intrusions

People's tensions run high in the event of an attack in process. When calls of intrusion reports hit pagers at 3:00 in the morning, many people act rashly. This section of the chapter outlines some tips for keeping everything together while reacting to an intrusion.

Don't Panic

Rule number one in reacting to an intrusion is to stay calm. Rash actions can cause errors that could inflict more damage than the original incident. Depending on how your IRT is structured, when an initial report of an intrusion comes in, brief all the contacts as soon as possible. Be careful with your wording so you do not instill fear in any non-IRT member you want it to be easy to gather information from any active parties.

Assemble Your Team ...