Handling and Responding to Network Security Incidents
Incident types to recognise
DDoS (volumetric, protocol, application-layer), MITM including ARP poisoning and DNS spoofing, session hijacking, port scanning and reconnaissance, unauthorised access, rogue access points and evil twins, VLAN hopping, data exfiltration, and lateral movement inside the perimeter. Each has a distinct evidence source; naming the right source is half the answer.
Evidence sources and what each gives you
- IDS/IPS (Snort, Suricata, Zeek): signature and anomaly alerts, connection summaries.
- Flow data (NetFlow/IPFIX, sFlow): who talked to whom, how much, how often - cheap, long retention, great for exfiltration volume and beaconing periodicity.
- Full packet capture (Wireshark, tcpdump): payload truth, but storage-hungry and often encrypted.
- Firewall/proxy/DNS logs: blocked and allowed egress, DNS tunnelling, DGA domains.
- SIEM: correlation across all of the above.
Traps: choosing flow data when the question demands payload content (or vice versa); forgetting that encrypted traffic still yields metadata (SNI, JA3, packet sizes, timing); assuming a single blocked alert means no compromise.
Response pattern
Identify and validate (correlate alerts, avoid chasing scanner noise) → capture evidence (start a pcap and preserve existing logs before they roll) → contain (ACLs, isolate the segment/VLAN, disable the port, sinkhole the C2 domain, null-route) → eradicate (patch, remove rogue devices, reset compromised credentials) → recover and monitor → lessons learned.
DDoS specifics: engage the ISP and a scrubbing provider, apply rate limiting and upstream blackhole routing for the target prefix, tune WAF/CDN protections; a perimeter firewall alone will be overwhelmed. ARP poisoning specifics: look for duplicate MAC-to-IP mappings and gratuitous ARPs; mitigate with dynamic ARP inspection and port security.
Rule of thumb: preserve logs before you contain - containment actions overwrite the very evidence that would tell you the scope.