Ask HN: Anonymous person sent proof of SSH access to our production server

Re:Ask HN: Anonymous person sent proof of SSH access to our ... by mboelen on Wednesday July 27, 2016 @10:11AM (#12172897)

Step 1: Try to get in contact with the person and see if he/she is willing to help you share details on entering your systems. Thank this person and see if you can provide a reward.

Step 2: Next step is setting up new systems, and start from scratch. Install the systems, start with basic system hardening and up-to-date software packages. Use https://github.com/CISOfy/lynis to validate your configuration.

Do not have any interaction or data exchange with the old (compromised) systems.

Step 3: Save all running systems to learn from the event. See if you can find the main cause why this happened.

Step 4: Learn about security, hire someone on your team with security knowledge.

Step 5: Do regular (technical) audits.

[ Parent | on HN ]

Re:Ask HN: Anonymous person sent proof of SSH access to our ... by ojilles on Wednesday July 27, 2016 @10:15AM (#12172919)

"Thank this person and see if you can provide a reward"

This should be:

"Thank this person and provide a reward"

Looking at all the other steps you'll have to go through to remedy the situation, this is the least of your costs. (Provided they cooperate and are not malicious)

[ Parent | on HN ]

Re:Ask HN: Anonymous person sent proof of SSH access to our ... by danesparza on Wednesday July 27, 2016 @02:17PM (#12175261)

+1 for link to lynis. I had never heard of that before!

[ Parent | on HN ]

Re:Ask HN: Anonymous person sent proof of SSH access to our ... by wila on Wednesday July 27, 2016 @05:31PM (#12176660)

You are replying to the author of lynis, might as well thank him for writing it :)

[ Parent | on HN ]

Re:Ask HN: Anonymous person sent proof of SSH access to our ... by mboelen on Thursday July 28, 2016 @01:29AM (#12178497)

You are welcome (even without thanking) :)

[ Parent | on HN ]