CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.4  Intrusion Detection            9  3.4.4  Incident Response

Six-Step Incident Response Process 1 3.5  Security Baselines

Additionally, you may wish to take advantage of some third-party channels. For example, if you seem to have a new vulnerability on your hands, you might want to contact your application, OS or security product (firewall, IDS, etc.) vendors to see what information you might be able to share with them, to help them protect against (or respond to) this vulnerability. You might want to contact CERT³⁴⁷ or the BUGTRAQ mailing list, to report the flaw so that other white hats find out about it and can take appropriate action (if it’s been aimed at you, at least one black hat’s already got the exploit). Depending on the type and severity of the incident, you may also want to alert law enforcement personnel.

Additionally, these channels often have information about how to respond to certain threats, such as explanations of software bugs you might have missed and information as to which versions of the software have had the bug fixed, and where to get them. As far as viruses are concerned, you can also check with the primary anti-virus sites, which often make available (even to non-customers) information on how to recover from common virus infections.

A debate has raged recently on the issue of “disclosure”. If you find a bug, who should you inform, when should you inform them, and how much should you say? Again, this is one of those issues where many people have opinions, but there is not necessarily one blanket answer appropriate for all situations. If you inform everyone at the same time, and crackers who might not have known about the hole beforehand find out about it and create an exploit, you could potentially be liable under the Digital Millenium Copyright Act for an activity affecting cybersecurity. On the other hand, if you inform the vendor, months go by, and the vendor has not informed you of plans to fix the hole you found, you have reason to believe an exploit is likely to show up before a fix is. Let your organization’s policies, your conscience and perhaps your management be your guide.

If you’re running UNIX or Linux, and would like a reference on “what to do if we’re compromised,” check out Bob Toxen’s Real World Linux Security³⁴⁸.

Six-Step Incident Response Process 1 3.5  Security Baselines