Re: Incident Response

[Chris Berry]

From: H C <[EMAIL PROTECTED]>
> My general question is just when do I need to do
> something other than just check my firewall logs for
> the source address and verify they weren't successful in
> gaining access anywhere vs. actually reporting an
> incident.

Why do anything?  The general sense is that the return
doesn't really justify the time required to report
such things.  So, if the scans are unsuccessful, why
bother with them at all?  Seems like a colossal waste
of time...

You could write a script to automatically scan them back, if they know you're watching they'll probably be less interested in messing with you.

Chris Berry
[EMAIL PROTECTED]
Systems Administrator
JM Associates

"Live dangerously, overclock your servers."







_________________________________________________________________
Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail