Best Practices for Recovery from the Malicious Erasure of Fi

[admin]

Best Practices for Recovery from the Malicious Erasure of Files

Original release date: January 19, 2012 at 3:43 pm
Last revised: January 19, 2012 at 3:43 pm


Cyber criminals can damage their victim's computer systems and data by
changing or deleting files, wiping hard drives, or erasing backups to
hide some or all of their malicious activity and tradecraft. By
wiping, or "zeroing out," the hard disk drives, which overwrites good
data with zeroes or other characters, the criminals effectively erase
or alter all existing data, greatly impeding restoration. This sort of
criminal activity makes it difficult to determine whether criminals
merely accessed the network, stole information, or altered network
access and configurations files, Completing network restoration
efforts and business damage assessments may be also hampered.

The FBI and DHS encourages businesses and individuals to employ
mitigation strategies and best practices such as:
* Implement a data back-up and recovery plan to maintain copies of
sensitive or proprietary data in a separate and secure location.
Backup copies of sensitive data should not be readily accessible
from local networks.
* Regularly mirror and maintain an image of critical system files.
* Encrypt and secure sensitive information.
* Use strong passwords, implement a schedule for changing passwords
frequently, and do not reuse passwords for multiple accounts.
* Enable network monitoring and logging where feasible.
* Be aware of social engineering tactics aimed at obtaining
sensitive information.
* Securely eliminate sensitive files and data from hard drives when
no longer needed or required.

The US-CERT web page at www.us-cert.gov hosts a wide range of tips,
best practices, and threat information for business and home users.

Relevant Url(s):
<http://www.us-cert.gov/>

====
This entry is available at
http://www.us-cert.gov/current/index.ht ... overy_from