IRM4728
Assignment 3
DUE 30 August 2024
, Question 1: Process Flow and States
a) Process Flow for the Problem
In the scenario where Josh suspects a compromised email server and the presence
of a rootkit, the process flow to address this problem would look something like this:
Incident Detection and Reporting:
Step 1: Identify and report suspicious activities or anomalies in the email server.
Step 2: Gather initial evidence and verify if unauthorized access or compromise has
occurred.
Incident Classification:
Step 1: Classify the incident based on its nature (e.g., malware infection, data
breach).
Step 2: Determine if the incident involves intellectual property or critical data.
Initial Response and Containment:
Step 1: Isolate the affected systems (e.g., disconnect email server from the network).
Step 2: Implement immediate measures to prevent further compromise (e.g., change
passwords, update firewall rules).
Investigation and Analysis:
Step 1: Conduct a detailed investigation to identify the root cause of the compromise.
Step 2: Analyze the rootkit and any potential damage to intellectual property.
Remediation and Recovery:
Step 1: Remove the rootkit and any other malware from the affected systems.
Step 2: Restore systems from clean backups and apply necessary patches or
updates.
Assignment 3
DUE 30 August 2024
, Question 1: Process Flow and States
a) Process Flow for the Problem
In the scenario where Josh suspects a compromised email server and the presence
of a rootkit, the process flow to address this problem would look something like this:
Incident Detection and Reporting:
Step 1: Identify and report suspicious activities or anomalies in the email server.
Step 2: Gather initial evidence and verify if unauthorized access or compromise has
occurred.
Incident Classification:
Step 1: Classify the incident based on its nature (e.g., malware infection, data
breach).
Step 2: Determine if the incident involves intellectual property or critical data.
Initial Response and Containment:
Step 1: Isolate the affected systems (e.g., disconnect email server from the network).
Step 2: Implement immediate measures to prevent further compromise (e.g., change
passwords, update firewall rules).
Investigation and Analysis:
Step 1: Conduct a detailed investigation to identify the root cause of the compromise.
Step 2: Analyze the rootkit and any potential damage to intellectual property.
Remediation and Recovery:
Step 1: Remove the rootkit and any other malware from the affected systems.
Step 2: Restore systems from clean backups and apply necessary patches or
updates.
