Pulling the Net

• Should only be done when a high risk exists to other systems but powering down represents unacceptable risks or a live system is desired.

• This allows an intruder the ability to detect investigations and cover his tracks.

• Data Preserved

  • Most

• Data Lost

  • Connection data upon timeouts
  • Any data destroyed by "dead-man switch" processes

• Risks

  • Dead-man switches - Known to exist

Notes: