How-to & Tuorials

How To Handle Network Intrusion

Cast your computers together and connect them – you got advantages. Just when you thought you took computing to the next level, you must realize that the security threats for your network just went one ( or several) notch(es) up too. What do you when you DO realize that your network has been hacked into?

If you catch someone lurking on your network or when you identify a hacking attempt — either to scan your network or to actually break into your network and crack a service — your first step would be to ensure that this would never happen again. In an organization, best practices mandate that you ought to have a special ‘Internal Crisis management team” or ” Network Crack Team” in place which would swiftly come to rescue. However, the steps you need to take are:

1. Raise an Alarm; Don’t use the network, but do it the old fashioned way -YELL: Well, do whatever. But don’t use the network anymore. Call someone up. If you are in an organization, job down to the Network Administration Center or just  scream. No emailing, no Internet Messaging or anything else for that matter that has anything to do with your network. use paper, pencils, Post-it notes or just talk. Software that specializes in sniffing the network constantly, like Colasoft’s New Capsa , does all the work of sniffing the network, monitoring traffic and the like.

2. Ensure that from the point of breach, everything is recorded : Look, if the perpetrators are there, this can be a legal case. So whatever you do — from the point where you noticed a possible breach into the network; the time of intrusion; the exact happenings; the gory detail — has to be recorded. Take backups of important files( this should have been done much earlier; read the post titled 5 hard-hitting reasons why You must consider Online-back-up” where I made the case for it). meticulous detail can save your day.

3. The Holes Buddy – Close them Quick : What do you do when your knee is hurt? You attend to it, don’t you? So what would you when you realize that your network has been hacked into? Find the hole and cover it up. Sometimes your in-built firewall, router or the packet filter might not indicate where the system has been breached; so you should check for the obvious targets like the web server, the servers; the ftp, etc. It’s best if you take the targeted service off the network and do the necessary things that would have been mentioned by the service vendor — like installing manufacturer’s updates; removing unnecessary services; repairing exposed vulnerabilities. If your organization can live with it, pull the plug off your entire network until the problem is solved.

Further Reading:

How To Monitor Network Traffic

Oh My Valiant Reader Warrior; A pleasure of Mine to have your presence. Like a Knight I'd Stand in your Honor, Serving with you with pleasure and delivering content that makes sense.

© 2008 softwarehawker.com.