427 Botnet fm qxd

www.syngress.com
412
Chapter 11 • Intelligence Resources
427_Botnet_11.qxd 1/9/07 9:56 AM Page 412

---

university, college, law enforcement, etc.), or other criteria that limits
the number of people who may join.
Membership organizations limit all or the bulk of information to
those who have acquired membership in the organization.
Vetting is a process that involves a critical examination of those
seeking membership with an organization. Members determine
whether a person may join, or should be removed from membership.
Confidentiality Agreements
Confidentiality agreements are used to limit information from being
disclosed outside an organization.They are often used in membership
organizations or environments where security is essential.
Unless you are in a situation where you have been ordered by the
courts to reveal information, you should only release information on
a need-to-know basis to prevent breaking any confidentiality
agreements.
Releasing information to third parties may result in membership to
an organization being revoked. In some situations, breaking a
confidentiality agreement could result in fines, civil damages, and
possible imprisonment.
What to Do with the Information When You Get It
Identify methods that can be used to improve security.
Use information on botnet removal procedures to properly restore
systems to a secure state.
Document all actions taken to restore systems, and gather evidence
that may be required by security professionals or law enforcement at
a later time.
Determine what information may have been compromised, and
whether clients or other individuals and organizations need to be
contacted about the incident.
www.syngress.com
Intelligence Resources • Chapter 11
413
427_Botnet_11.qxd 1/9/07 9:56 AM Page 413

---

The Role of Intelligence Sources in Aggregating 
Enough Information to Make Law Enforcement
Involvement Practical
Try to preserve as much evidence as possible for further investigation.
Identify areas that were affected by an incident, and try to provide as
much access as possible to law enforcement specialists during the
investigation.
Identify information that will require a warrant or subpoena to
release.