Re: The "unplug the cord" dilemma

From: De Velopment <devel(at)www2.kparker.org>
Date: Sat Mar 29 2003 - 16:27:44 EST

Hello Omar,

On 27 Mar 2003, Omar Herrera wrote:

> I was looking for documentation available discussing circumstances where

I would like to suggest a fourth option: Unplugging the Ethernet cable from the system itself, but leaving it on, at least for a bit. This is, of course, safer than option a) above, since it will put an immediate stop to any attacks the system might have been making to others. Also, it MIGHT allow one to see what processes are running, though, like with option a) above, the commands, on the system itself, could be trojaned.

Rather than when an individual option is appropriate, the question may be better asked, which option should be started with, as I submit that the offline backup and forensics need to be done in any case where getting answers is important. In cases likely to go to court, option c), right away, might be appropriate, to eliminate "tampering with evidence" defenses. (I am not a lawyer, however).

Good luck and best regards,

Ken Parker

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Sun Mar 30 10:29:49 2003