10.5.8. Recovering from intrusion

In short, stay calm. Then take the following actions in this order:

• Disconnect the machine from the network.

• Try to find out as much as you can about how your security was breached.

• Backup important non-system data. If possible, check these data against existing backups, made before the system was compromised, to ensure data integrity.

• Re-install the system.

• Use new passwords.

• Restore from system and data backups.

• Apply all available updates.

• Re-examine the system: block off unnecessary services, check firewall rules and other access policies.

• Reconnect.