This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

.NET Incident Response

Revision as of 13:36, 24 November 2008 by Brennan (talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

.NET Incident Response

Understanding how to respond to an incident before it occurs is critical to recovering operations. This section contains information for incident response, and specific content for .NET web application and service incident response handling. In addition to traditional logging functions, how do we know if our application, service, database or other software has been exploited.

Areas of Concern

  • Incident Response Plan

As they say, it is not if, it is when you are attacked, what is the plan?

  • Communicating

Who uses your software? How do you communicate the incident to your user base?

  • Activating the plan

How do we know we've been attacked. Applications and services need to be instrumented to provide information specific to functionality within the software. What guidance or tools are needed to provide information to incident response personnel.

  • Containment

Limit the exposure of the incident by isolating the damage.

  • Attack Identification and Severity assignment

Find the origin of the attack. Estimate exposure.

  • Evidence handling best practices
  • Recovery and Continuity

Articles & Projects

Avoiding a Meltdown: The Management Incident Response Team

Windows Best Practices for Security Incident Response

Guide to Integrating Forensic Techniques into Incident Response

Responding to IT Security Incidents

Forum for Incident Response and Security Teams


Cheat Sheet for Server Admin.

Checking Microsoft Windows® Systems for Signs of Compromise


SAN's SysAdmin Cheat Sheet

Creating a Computer Security Incident Response Team: A Process for Getting Started

Computer Security Incident Response Team FAQ

Handbook for Computer Security Incident Response Teams

Incident Response Resources

NIST SP800-86: Guide to Integrating Forensic Techniques into Incident Response


Incident Response Kit

Helix LiveCD

Windows Preinstallation Environment (WinPE)