RE: RE: Incident response to being scanned

yeah, its tempting to just go ahead and block the source address, but because most of these guys either have a dynamic address from their ISP, you really don't want to block other users that may inherit that address, so it's best to just copy your logs and send it to their ISPs abuse email.

-----Original Message-----
From: Bob Kelley [mailto:b0bk3ll3yjr@adelphia.net] Sent: Saturday, April 26, 2003 5:14 AM
To: security@riggstar.com
Cc: security-basics@securityfocus.com
Subject: Re: RE: Incident response to being scanned

Yes. All patched, behind a sound firewall and IIS Lockdown. It's a static site so URLScan works like a champ.
>
> From: "Security News" <security@riggstar.com>
> Date: 2003/04/26 Sat AM 01:53:22 EDT
> To: "Bob Kelley" <b0bk3ll3yjr@adelphia.net>
> Subject: RE: Incident response to being scanned
>
> Heck yeah, report those folks to their ISPs. Also, is your webserver
locked
> down, and I don't only mean security patches?
>
> -----Original Message-----
with
> code red. The source addresses are not always the same. I am confident
date.
> I perform weekly vulnerability scans of my equipment to make sure I am
-
> Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the
to
> ensure your place. http://www.securityfocus.com/BlackHat-security-basics

--

>

>

>




---------------------------------------------------------------------------
Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the 
world's premier event for IT and network security experts.  The two-day 
Training features 6 hand-on courses on May 12-13 taught by professionals.  
The two-day Briefings on May 14-15 features 24 top speakers with no vendor 
sales pitches.  Deadline for the best rates is April 25.  Register today to 
ensure your place.  
http://www.securityfocus.com/BlackHat-security-basics 
----------------------------------------------------------------------------