Was our website outage a cyber attack? How do we find out?
Check the ordinary causes first, then look for the signs of an attack. Many outages come from an expired certificate or domain, a full disk, a failed update or a problem at the hosting provider. Ask your provider and check its status page, then look at the web server's logs: a sudden flood of requests from many addresses points to a denial-of-service attack; changed pages, new administrator accounts or unknown files point to a compromise of the site itself; a changed DNS record points to an attack on your domain registration. Keep the logs before restarting anything. If the site holds customer data or takes payments, treat a compromise as a possible data breach. NetSenX does not protect public websites hosted outside your network; if the web server sits in your network, it shows unusual outbound connections and data volume from it.
Read next
Related questions
- Does network detection stop DDoS attacks, and how does it differ from DDoS protection?
- What does NetSenX give us during an incident?
- A supplier with access to our systems has been hacked. What do we do?
- Is it a compromised account or a compromised device, and why does it matter?
- What are the early warning signs of ransomware on a network?