Policies for having identified an attack via IPS....

[thegalaxyboy]

Hello,

What sort of policies would systems security staff recommend in an environment where a IPS device is deployed. For example, say an attack has been detected - what policy and procedure would you recommend to have in place for this?

Thanks.

 

[compuveg]

Well, attacks from the internet I would ignore, they're to be expected.

There should be a swift policy in place for internal attacks that would report the incident, locate the attacker in the network, remove them, then report the conclusion.