Microsoft® Windows® Security Resource Kit, Second Edition

Chapter 31. Responding to Security Incidents

In this chapter:
Common Indicators of Security Incidents	670
Analyzing a Security Incident	676
Conducting Security Investigations	680
Implementing Countermeasures to a Security Incident	687
Recovering Services After a Security Incident	690
Conducting a Security Incident Postmortem	690
Best Practices	691
Additional Information	692

As a network administrator, you must be able to recognize when a security incident is under way. Unfortunately, not all attacks are obvious. Recognizing that the network is under attack early is essential to protecting information or computers that have not yet been compromised. The detection of security incidents centers on investigating events that fall outside of the normal behavior ...