My brother on what to do after you get hacked

Uncategorized 1 Minute

My brother is an IT guy and writes for ComputerWorld. He gives a list of what to do after your servers get hacked.

Published by Robert Scoble

I help entrepreneurs build their technology business' story, help with getting ready for investors, with other launch plans, and many other strategic things that can help your new startup. Call to talk: +1-425-205-1921 (text first).

Published

21 thoughts on “My brother on what to do after you get hacked”

  4. Pingback: Computerworld Blogs

  5. My guess is for 99% of the admins out there step 11: ‘blow the operating system away, reinstall from scratch, and focus on preemptive security. ‘ would be the only step. Time pressure, stretched budgets, it’d be lovely to have the time to go on a forensics safari but I sure don’t.

    Like

  6. My guess is for 99% of the admins out there step 11: ‘blow the operating system away, reinstall from scratch, and focus on preemptive security. ‘ would be the only step. Time pressure, stretched budgets, it’d be lovely to have the time to go on a forensics safari but I sure don’t.

    Like

  7. My guess is for 99% of the admins out there step 11: ‘blow the operating system away, reinstall from scratch, and focus on preemptive security. ‘ would be the only step. Time pressure, stretched budgets, it’d be lovely to have the time to go on a forensics safari but I sure don’t.

    Like

  8. Ok, patch your systems daily and run IDS’s and you will not get hacked, I really hate it when an admin says “We have to test the patches first”, Well that’s the vendor’s job wether it be MS, Redhat, etc…

    If you do get hacked,
    1. don’t blow it away, remove the box from the network,
    2create a snapshot of the system (for legal reasons.)
    3. blow away and reinstall, or better yet, pull the drives and install new drives and rebuild the system.

    Like

  9. Ok, patch your systems daily and run IDS’s and you will not get hacked, I really hate it when an admin says “We have to test the patches first”, Well that’s the vendor’s job wether it be MS, Redhat, etc…

    If you do get hacked,
    1. don’t blow it away, remove the box from the network,
    2create a snapshot of the system (for legal reasons.)
    3. blow away and reinstall, or better yet, pull the drives and install new drives and rebuild the system.

    Like

  10. Ok, patch your systems daily and run IDS’s and you will not get hacked, I really hate it when an admin says “We have to test the patches first”, Well that’s the vendor’s job wether it be MS, Redhat, etc…

    If you do get hacked,
    1. don’t blow it away, remove the box from the network,
    2create a snapshot of the system (for legal reasons.)
    3. blow away and reinstall, or better yet, pull the drives and install new drives and rebuild the system.

    Like

  11. Simple: dump your windows infrastructure, and go with a securable system instead. If you have windows apps you can’t get rid of, run them under VMWare on Linux, BSD, Solaris, or (coming soon), Mac OS X. They’ll still get pwn3d, but you can trivially restart them from a pristine image.

    Like

  12. Simple: dump your windows infrastructure, and go with a securable system instead. If you have windows apps you can’t get rid of, run them under VMWare on Linux, BSD, Solaris, or (coming soon), Mac OS X. They’ll still get pwn3d, but you can trivially restart them from a pristine image.

    Like

  13. Simple: dump your windows infrastructure, and go with a securable system instead. If you have windows apps you can’t get rid of, run them under VMWare on Linux, BSD, Solaris, or (coming soon), Mac OS X. They’ll still get pwn3d, but you can trivially restart them from a pristine image.

    Like

  14. Pingback: Pig Pen - Web Standards Compliant Web Design Blog » Blog Archive » 11 Things To Do After A Hack

  15. Definitely agree patching is a necessity, but so is change management. You cant have people making arbitrary changes without documentation.

    In response to the above post, IDS are reactive…they do not prevent anything….they are not designed to. It is the vendors job to test that patch to make sure it doesnt cause issues with the OS. It is the administrators job to test the patch to make sure it doesnt interfere with other applications / modifications made since it was a fresh OS. Just throwing on the latest patch blindly is going to cause more problems that it will fix. You have to test patches, no matter the source.

    –C

    Like

  16. Definitely agree patching is a necessity, but so is change management. You cant have people making arbitrary changes without documentation.

    In response to the above post, IDS are reactive…they do not prevent anything….they are not designed to. It is the vendors job to test that patch to make sure it doesnt cause issues with the OS. It is the administrators job to test the patch to make sure it doesnt interfere with other applications / modifications made since it was a fresh OS. Just throwing on the latest patch blindly is going to cause more problems that it will fix. You have to test patches, no matter the source.

    –C

    Like

  17. Definitely agree patching is a necessity, but so is change management. You cant have people making arbitrary changes without documentation.

    In response to the above post, IDS are reactive…they do not prevent anything….they are not designed to. It is the vendors job to test that patch to make sure it doesnt cause issues with the OS. It is the administrators job to test the patch to make sure it doesnt interfere with other applications / modifications made since it was a fresh OS. Just throwing on the latest patch blindly is going to cause more problems that it will fix. You have to test patches, no matter the source.

    –C

    Like

  18. Pingback: Forever Geek

Comments are closed.