Monitor Intrusion

Practice

Maybe you should let the intrusion continue for a while

Monitor the attacker's activities.

See where they're coming from.. However, most attackers cover their tracks.

Types of attack

• Many attackers are random: they just want another bot.
• Hack for profit

Criminal Prosecution

• DO NOT proceed forensics yourself!
• Law and technology: Evidence must be handled very carefully.
• Must avoid defense charges of tampering, forgery, misinterpretation; parties with more interest in a case can be potrayed as biased.
• Forensic analysis for crime $\neq$ problem solving for engineering!