Reacting to Intrusions
People's tensions run high in the event of an attack in process. When calls of intrusion reports hit pagers at 3:00 in the morning, many people act rashly. This section of the chapter outlines some tips for keeping everything together while reacting to an intrusion.
Don't Panic
Rule number one in reacting to an intrusion is to stay calm. Rash actions can cause errors that could inflict more damage than the original incident. Depending on how your IRT is structured, when an initial report of an intrusion comes in, brief all the contacts as soon as possible. Be careful with your wording so you do not instill fear in any non-IRT member you want it to be easy to gather information from any active parties.
Assemble Your Team ...
Get Microsoft® Windows® 2000 Security Handbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
