Countering Security Threats

If your systems are hacked or intruded upon by an unauthorized party, you should call your local FBI office or contact the National Infrastructure Protection Center (NIPC) Watch Operations Center 1-888-585-9078. In the event that you experience a crime against your computer systems the FBI and the NIPC recommends that you:

• Respond quickly. Contact Law Enforcement. Traces are often impossible if too much time is wasted before alerting law enforcement or your own incident response team.
• If unsure of what actions to take, DO NOT stop system processes or tamper with files. This may destroy traces of intrusion.
• Follow organizational policies and procedures. (Your organization should have a computer incident response capability and plan in place.)
• Use the telephone to communicate. (Attackers may be capable of monitoring e-mail traffic.)
• Contact the incident response team for your organization. (Quick technical expertise is crucial in preventing further damage and protecting potential evidence.)
• Establish points of contact with general counsel, emergency response staff, law enforcement. (Pre-established contacts will help in a quick response effort.)
• Make copies of files an intruder may have altered or left. If you have the technical expertise to copy files this action will assist investigators as to when and how the intrusion may have occurred.
• Identify a primary point of contact to handle potential evidence. Establish chain-of-custody of evidence. (Potential hardware and software evidence that is not properly controlled may loose its value.)
• DO NOT contact the suspected perpetrator.

Information to Help Investigators

Compile as much information and data possible about the incident. Information that law enforcement investigators will find helpful includes:

• Date, time, and duration of incident.
• The name, title, telephone number, fax number, and e-mail of the point of contact for law enforcement as well as the name of your organization, address, city, state, zip code, and country.
• The physical locations of computer systems and or networks that have been compromised.
• If the systems are managed in-house or by a contractor.
• If the affected systems or networks are critical to the organization's mission
• If it is a part of the critical infrastructure, which sector was affected:

1. Banking and finance.
2. Emergency services.
3. Gas or oil storage and delivery.
4. Government operations.
5. Power.
6. Transportation.
7. Telecommunications.
8.  Water supply systems

The nature of the problem, which could include intrusion, system impairment, denial of resources, unauthorized root access, web site defacement, compromise of system integrity, theft, or damage.

If the problem had been experienced before.

• Suspected method of intrusion or attack which could include a virus, exploited vulnerability, denial of service, distributed denial of service, trapdoor, or Trojan horse.
• The suspected perpetrators and the possible motivations of the attack  which could include an insider or disgruntled employee, former employee, or competitor.
• If the suspect is an employee or former employee you should determine and report the type of system access that the employee has or had.
• An apparent source (IP address) of the intrusion or attack if known and if there is any evidence of spoofing.
• What computer system (hardware, operating system, or applications software) was affected.
• What security infrastructure was in place which could include an incident response team, encryption, firewall, secure remote access or authorization tools, intrusion detection system, security auditing tools, access control lists, or packet filtering.
• If the intrusion or attack resulted in a loss or compromise of sensitive, classified or proprietary information.
• If the intrusion or attack resulted in damage to systems or data.
• What actions to mitigated the intrusion or attack have been taken which could include the system being disconnected from the network, system binaries checked, backup of affected systems, or log files examined.
• What agencies have been contacted which could include state or local police, CERT, or FedCIRC.
• When the last time your system was modified or updated and the name of the company or organization that did the work (address, phone number, point of contact information).

Information to Determine Damages or Loss

• It is also necessary to determine a dollar value of damage, business loss, and cost to restore systems to normal operating conditions. The following information is helpful in determining dollar amounts.
• In the event that repairs or recovery were performed by a contractor you should determine the charges incurred for services.
• If in-house staff were involved in determining extent of the damage, repairing systems or data, and restoring systems to normal operating conditions you should determine the number of hours staff expended to accomplish these tasks and the hourly wages, benefits, and overhead associated with each employee involved in the recovery.
• If business was disrupted in some way you should determine the number of transactions or sales that were actually disrupted and their dollar value.
• If systems were impaired to the point that actual disrupted transactions or sales cannot be determined then you should determine the dollar value of transactions or sales that occur on a comparable day for the duration of the system outage.
• If systems are used to produce goods, deliver services, or manage operations, then what is the value of that disruption. (You may have had similar experiences if operations were disrupted because of inclement weather, fires, earthquakes, or other disruptive incidents.)
• If systems were physically damaged you need to know what you paid to acquire and install the systems.
• If systems were stolen you need to know what you paid to acquire and install the systems and the cost of actions taken to assure that information on the stolen systems cannot be used to access systems.
• If intellectual property or trade secrets were stolen then you need to determine the value of that property.