Security Strategies in Linux Platforms and Applications, 3rd Edition

Best Practices: Security Breach Detection and Response

You must plan for a security breach. It’s best if you have a gold baseline system ready to go to take the place of at least any critical system on the local network. Of course, unless you know the cause of the breach, blindly replacing a compromised system could prove foolhardy. You must know what happened. If there is a flaw with the configuration of the system, you should update that gold baseline first.

To understand when there might be a problem, regular performance audits are appropriate. Systems that deviate significantly from baseline performance with respect to CPU and RAM usage may be suspect. Because you cannot spend all day on watch, the system status tool can help. If an issue ...