Hypothetical Break-In
Consider the following five questions and write a response to each one.
How do you go about finding information when you have been told that there has been a break-in?
What servers were compromised?
Was network equipment comprised?
What user accounts were employed to do gain access?
What vulnerabilities were exploited?
What can be done to prevent a recurrence?
When investigating a break-in, the first step is to determine what information has been compromised. It is often useful to start by gathering details about the incident such as when it happened, who was onsite at the time, how many people accessed the system and for how long. Once you have an overview of the situation, you can begin to assess what servers were compromised or if any network equipment was affected.
Next, it is important to look into potential vulnerabilities that could have enabled access to systems or data. It may be necessary to review firewall rules and authentication protocols that govern access control in order to identify any issues that could have allowed unauthorized entry. Additionally, server logs should be inspected for signs of suspicious activity such as attempts at brute force login attempts or downloads of large amounts of data. Finally, it is important to consider whether there were any other security measures in place before the attack occurred so as not to overlook any weaknesses that could have enabled malicious actors entry into networks or systems vulnerable assets.
In addition to these more technical steps, it is also essential for investigators conducting break-ins investigations understand legal aspects relating to criminal acts committed using computers and computer networks. Laws governing cybercrime vary from state-to-state and country-to-country but understanding them can help ensure perpetrators are held accountable according their actions if evidence can be found linking them back directly with the initial breach itself.