Sunday, November 23, 2008

Incident Response References

Tips for examining a suspect server to decide whether to escalate for formal incident response:
http://www.zeltser.com/network-os-security/security-incident-survey-cheat-sheet.doc

Incident Questionnaire for Responders:
http://www.zeltser.com/network-os-security/security-incident-questionnaire-cheat-sheet.doc

Windows Intrusion Discovery:
http://sans.org/resources/winsacheatsheet.pdf http://www.ucl.ac.uk/cert/win_intrusion.pdf

Linux Intrusion Discovery:
http://sans.org/resources/linsacheatsheet.pdf
http://www.ucl.ac.uk/cert/nix_intrusion.pdf

Building Incident Response Plan:



Based on BackTrack4, with additional case tracking and collaboration tools, in addition to some network analysis tools that might be helpful for network forensics. More info here.


0 comments: