What happens on your server at night?
Prevention is better than a cure, and all that, but what about when an attack isn't preventable? What do organisations do to ensure that they know who hit them? Judging by how long it takes to get answers, I'd say they don't do enough.
It's become almost generally accepted that in the aftermath of an attack, an organisation is going to take a while to recover. You may even sympathise with them. There's a whole heap of issues to address, such as working with their hosting provider, checking what patches they actually had and searching for any evidence that the hackers left behind, all while trying to bring their server back online from back-ups, and ensuring that it's no longer vulnerable. I think that how an organisation responds in the aftermath of an attack is the real test of its security. It weeds out those who understand their network, and those who simply put up "security installed here" signs — the digital equivalent of dummy security cameras.
If organisations are really on top of their security, why is it that most take so long to complete their investigations, or never find out how they were attacked?
