Compromised Web Server: Isolate, Shut Down, or Patch?
A software development company discovers that a public-facing web server has been compromised and is being used to send spam and participate in a botnet. The server hosts a customer portal used by 50,000 users for licensing and downloads. The security team wants to shut down the server immediately to stop the botnet activity. However, the server also contains a pending critical security patch that, if applied, requires a reboot and 30 minutes of downtime. The customer support team reports that 200 users are currently active. The incident response plan requires evidence collection before any destructive action, but the team has no forensic image yet. The legal team is concerned about liability if the server continues attacking third parties. The CISO must decide whether to isolate, shut down, or patch first.
1. What containment strategy should the CISO choose, and why? Consider ISO/IEC 27035 response principles and the competing priorities.
Read the worked answer
The CISO should choose network isolation of the server from the internet while keeping it accessible for forensic imaging and internal analysis. Shutting it down immediately would stop the botnet traffic but destroy volatile evidence (memory, processes, network connections) and disrupt 200 active users without warning. Patching first is risky because the backdoor may persist, and the reboot could trigger destructive actions or alert the attacker. Isolation blocks outbound spam and botnet communication while preserving evidence and allowing a controlled response. The CISO should: (1) isolate at the firewall/load balancer; (2) capture memory and disk images; (3) notify the ISP and possibly law enforcement; (4) communicate to affected users about a brief maintenance window; (5) then rebuild or patch the server from a known-good state. 27035 emphasizes containing the incident, preserving evidence, and restoring services in a controlled way. The legal liability from continued attacks is a strong argument for immediate isolation, but not for destruction of evidence.
2. How should the incident response team handle evidence collection and legal concerns?
Read the worked answer
The team should follow 27035 evidence-handling principles: identify, collect, preserve, document, and maintain chain of custody. Before isolation, capture volatile data (memory, running processes, network connections). After isolation, create a forensic image of the disk. Document who collected what, when, and where. The legal team should be involved to ensure the evidence is admissible and to assess notification obligations. If the server was attacking third parties, the company may have a duty to notify its ISP and possibly affected parties. The team should not patch or reboot until evidence is secured, unless there is an imminent threat to life or critical infrastructure. The legal concern about liability supports isolation, not destruction. Evidence can also help identify the attacker and prevent recurrence.
3. What communication should go to affected customers, and when?
Read the worked answer
Communication should be timely but factual, after isolation and initial assessment. Customers need to know if the portal will be unavailable and for how long. The message should state that a security issue was detected, the portal is temporarily offline for investigation and remediation, and no customer data breach has been confirmed (if true). Avoid technical details that could aid attackers or cause unnecessary alarm. Use the status page, email, and social media as appropriate. If evidence later shows customer data was accessed, a separate breach notification must follow legal requirements. 27035 communication principles: coordinate with legal and communications, be transparent within the limits of the investigation, and provide updates at defined intervals. The 200 active users should receive an immediate in-session notice or email about the maintenance window.