IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 6.31 Procedural patterns following a loss of system
integrity
Initiation responsibility: Head of IT Section, IT Security management
Implementation responsibility: Administrator, IT users
If a UNIX system starts behaving in an unexpected manner (e.g. undefined
system behaviour, data gone missing, modified file contents, steady reduction
of storage space although no data has been saved), a loss of integrity may have
occurred. This can result from misuse of the system, for example, as a result
of changes to the system settings, import of a Trojan horse or a computer
virus.
Users should observe the following procedure in this case:
- Keep calm.
- Notify the Administrator.
- Exit the current programs.
The Administrator must take the following steps:
- Shut down the system.
- Start up the system so that it can only be accessed from the console (e.g.
single-user mode).
- Take a complete backup (this can be helpful if data or tracks are destroyed
in the subsequent investigation).
- Check the executable files for visible modifications, e.g. creation date and
file size (as an aggressor could reset these to their original values, the
integrity of the files should be checked with checksum procedures, such as
tripwire).
- Deletion of the executable files and play-back of the original files from
write-protected data media (cf. S 6.21 Backup copy of the software used).
(Programs from data backups must not be replayed).
- Check and, if necessary, reload the system directories and files and their
attributes (e.g. /etc/inetd.conf, /etc/hosts.equiv, cron- and at-jobs, etc.),
- Check the attributes of all user directories and files, e.g. using checksum
procedures like tripwire, and if necessary reset to minimal settings (i.e.
rights confined to file owner, no root files in user domains, rhost and
.forward files, also blocked accounts).
- Change all the passwords.
- Ask users to check their domains for irregularities.
Once all the passwords have been changed, they must be notified to the users
concerned. No password or password derivation scheme which is known to all
the users should be used here. It is better to generate the passwords randomly
and notify the users by a reliable route, e.g. in sealed envelopes. These
passwords should be changed immediately after logging on for the first time.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Misuse
Do not panic!
Complete data backup
Check executable files
Reload original files
Check attributes
Generate new
passwords using
randomisation