Recovery from Attack

• Document all steps taken

• Disconnect from network (Change to single user mode)

• Build an image of the compromised system

• Investigation purpose

• Evidence

• Insurance $$

Previous slide

Next slide

Back to first slide

View graphic version