Show Case

• 

  Case 1

  Internal Server connected to malicious website

  • Related Devices：Checkpoint Firewall(Log) & AlienLab Threat Intelligence System
  • Scenarios：
    1. The internal server is suspected of being installed with a backdoor and sending data to an external malicious website.
    2. When the internal server performs general web browsing, there may be an advertisement page embedded in the malicious link.
  • Response：
    1. Confirm the external malicious website whether it's still dangerous
    2. Check if the internal server is implanted with malware and clean it
    3. Host forensic of endpoint detection for the related hosts

• 

  Case 2

  The Sender is from a malicious IP

  • Related Devices：Checkpoint Firewall(Log) & AlienLab Threat Intelligence System
  • Scenarios：
    1. Suspected external malicious server was sending mails to internal server
  • Response：
    1. Confirm the internal server whether has a mail service
    2. Tracking the external sending server whether is abnormal
    3. Confirm whether the email is sent successfully, and notify the recipient to check if the email is abnormal or delete it directly.
    4. If check it's a malicious mail or the mail is already open, proceed clearing the malicious software and evaluated for possible damage.

• 

  Case 3

  Webpage Attack

  • Related Devices：Data packet and AlienLab vulnerability Scanning database
  • Scenarios：
    1. The web server is being attack by a hacker, for example
       • Execution instruction
       • Stealing passwords
       • Stealing database data
  • Response：
    1. Confirm that the web attack was whether successful and evaluate the damage that may be caused
    2. Immediately reinforce all webpages' vulnerability and re-execute vulnerability scans
    3. Host forensic of endpoint detection for the related hosts 

• 

  Case 4

  Blocking Service Attack

  • Related Data packet
  • Scenarios：
    1. Suffering from hackers to perform UDP Flooding attacks
  • Response：
    1. Evaluate damage that may be caused by blocking service attacks
    2. If necessary, include the attack IP in the firewall on a short-term blocking list

• 

  Case 5

  Network Scanning Attack

  • Related Device：Intrusive Prevention Device Log
  • Scenarios：
    1. Scenarios
  • Response：
    1. Confirm the domain query request from the server is whether legal
    2. If necessary, include the attack IP in the firewall on a short-term blocking list

• 

  Case 6

  Brutal attack of password cracking

  • elated Device：Sever System Log and AlienLab NIDS
  • Scenarios：
    1. he file transfer service opened by the web server suffers intensive attempts to log in in a short period of time.
  • Response：
    1. Confirm whether the attempted account is a valid account and the password has been guessed or not.
    2. Require customers to set more complicated passwords and change them regularly
    3. Limit the IP of each account that can be connected if necessary.