After an Exploit: mitigation and remediation

SecurityFocus talks about getting hacked: After an Exploit: mitigation and remediation. Frankly, the article seems a bit misnamed to me. Ignore the "after an exploit" part. It's really about prevention and mitigation of particular attacks.

As we all know, prevention, detection and response are our three main lines of defence against threats, with a good administrator putting most focus on prevention. As the old adage goes, "an ounce of prevention is worth a pound of cure" - a 1:16 ratio for the metrically inclined - but there's always going to be the odd occasion where prevention fails, either through a lack of time or a mistake in one's security procedure. In this article we describe a few hardening and alerting methods for Unix servers that help block vectors for various attacks, including two web-based application attacks and the brute-forcing of SSH passwords. The article then looks at what an administrator should do post-compromise. These incidents have been drawn from both honeypots and real systems.