Re: Incident Response

["Chris Berry" <compjma () hotmail com>]

> From: H C <keydet89 () yahoo com>
> > My general question is just when do I need to do
> > something other than just check my firewall logs for
> > the source address and verify they weren't successful in
> > gaining access anywhere vs. actually reporting an
> > incident.
>
> Why do anything?  The general sense is that the return
> doesn't really justify the time required to report
> such things.  So, if the scans are unsuccessful, why
> bother with them at all?  Seems like a colossal waste
> of time...

You could write a script to automatically scan them back, if they know 
you're watching they'll probably be less interested in messing with you.

Chris Berry
compjma () hotmail com
Systems Administrator
JM Associates

"Live dangerously, overclock your servers."







_________________________________________________________________
Tired of spam? Get advanced junk mail protection with MSN 8. 
http://join.msn.com/?page=features/junkmail