Recording the Expanded Incident Lifecycle timelines

When reporting on a major incident it is important to record the timelines. The best method to have these times is to use a screen capture tool. Alternative methods of determining these times is:

If the major incident involved a server check the event log for the logon/logoff messages of RDP and use the times logged as a guideline. Make certain that the policy for auditing successful logons is enabled for all servers. The event logs can also be mined for other information.
If the major incident involved network equipment use a client like Putty. Putty allows the whole session to be logged. It is a good idea to have logging permanently enabled for Putty. If you have a Cisco ACS server, it is possible to configure the network equipment to log all access and commands issued. Additional, the network equipment can be mined for syslog information either by configuring a logging buffer on the device or sending the syslogs to a daemon like Kiwi.
If you worked on a system that had a web front end, check your browser history. Web Historian is a good tool to do this task.

Comments

easywall - Web interface for easy use of the IPTables firewall on Linux systems written in Python3.

Firewalls are becoming increasingly important in today’s world. Hackers and automated scripts are constantly trying to invade your system and use it for Bitcoin mining, botnets or other things. To prevent these attacks, you can use a firewall on your system. IPTables is the strongest firewall in Linux because it can filter packets in the kernel before they reach the application. Using IPTables is not very easy for Linux beginners. We have created easywall - the simple IPTables web interface . The focus of the software is on easy installation and use. Access this neat software over on github: easywall

No Scrubs: The Architecture That Made Unmetered Mitigation Possible

When building a DDoS mitigation service it’s incredibly tempting to think that the solution is scrubbing centers or scrubbing servers. I, too, thought that was a good idea in the beginning, but experience has shown that there are serious pitfalls to this approach. Read the post of at Cloudflare's blog: N o Scrubs: The Architecture That Made Unmetered Mitigation Possible

LDWin: Link Discovery for Windows

LDWin supports the following methods of link discovery: CDP - Cisco Discovery Protocol LLDP - Link Layer Discovery Protocol Download LDWin from here.

Thinking problem management!

Search This Blog