Machine is compromised, but not actively doing ìsomething badî

• Attempt to contact the owner, leave v-mail

• Ask the owner to take the machine off the network

• Usually, we disable the network drop (Machine must be off the network the same business day.)

• Then we follow the same procedure for an attacking machine.

Previous slide

Next slide

Back to first slide

View graphic version