Best Practice Detail

13-8-8562

Network Operators and Service Providers should isolate the box and check integrity of infrastructure and agent if an infected (zombie) device is detected. Adjust firewall settings, patch all systems and restart equipment. Consider making system or hostile code available for analysis to 3rd party such as US-CERT, NCC, or upstream provider's security team if hostile code does not appear to be known to the security community. Review Incident Response Post-Mortem Checklist (NRIC BP 8548).

Status: Rollover New

References/Comments:

Historical events:

Network Operators
Service Providers
Cable
Internet/Data
Satellite
Wireless
Wireline
Cyber Security
Disaster Recovery
Emergency Preparedness
Intrusion Detection
CSRIC VII: Rollover New In CSRIC VII