Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

After being hacked companies often give numbers and details on how much of their data was compromised e.g "13K user and passwords".

After a possible intrusion how do you know what the hacker did in your server?

share|improve this question
1  
Might be better at security.SE –  TheLQ Jul 7 '11 at 17:59
    
TheLQ i had no idea that one existed –  amosrivera Jul 7 '11 at 18:00
    
Just for future reference, thats all –  TheLQ Jul 7 '11 at 18:03
add comment

3 Answers 3

up vote 2 down vote accepted

Security Stack Exchange has a range of Questions and Answers in this area - you should have a look.

While post-incident forensics is quite a mature field, and I have managed a number of these, it is high cost, and most organisations take the sensible view of assuming worst case - the attacker could have accessed everything. A usual tack is to wipe machines and revert to a backup taken before the incident - but this can be very expensive in a large enterprise.

In terms of likelihood of identifying activities, if you are logging at the perimeter you can often find out how the attacker got in, but after that point, if they set up an SSH server or other encrypted channel into your network you will lose the detail after that.

For individual servers, you may have logs which can be trawled through (very time consuming) but if the attacker got root on these machines they could alter the logs to hide any evidence - which is why it is always recommended to log to a machine elsewhere which has a write once, read many filesystem (which means anything written there can never be deleted)

Layers of security do help in not only preventing intrusion, but in detecting it before it becomes a 'lift off and nuke from orbit' scenario.

As an interesting aside - many times when running a forensic analysis after an incident, teams find evidence of other, longer-term, well-hidden intrusions...worried, anyone?

share|improve this answer
add comment

Assume a worst case scenario. Examine your logs, figure out everything they might have gotten access to, and assume they took a copy of all of it.

share|improve this answer
add comment

Hopefully their activity is logged and you can analyze what they have done. Otherwise, without any sort of trace of their activity, it's hard to determine what could have been done. I would always assume the worst, but hope for the best. Usually companies report the worst case intrusion to alert their customers to what may have been compromised.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.