Security Strategies in Linux Platforms and Applications, 3rd Edition

Disaster Recovery from a Security Breach

The response to a security breach depends on what happened. In general, you want to have gold baseline systems ready to go in case of a security issue. When appropriately configured, they can be put in place of compromised systems. Ideally, before you put these into place, you should determine whether that gold baseline system is flawed.

If data are needed from compromised systems, you must know what has been compromised. During forensic analysis of a compromised system, you should be able to review the differences with the original configuration with tools such as AIDE and Tripwire. Reviewing the differences should help you identify what went wrong. It should identify files that have been changed or ...