When you have just detected your website is currently under a hack attack that is attempting to penetrate your website, I am not including Denial of service in my question, what do you do? Are there best practice guidelines to follow?
I have found many posts about what you do after a hack, but what do you do when you are under attack does not seem clear.
I am primarily talking about IIS and ASP.net sites, but the question is relevant to all internet facing sites.
Assume that the site is behind a firewall and all requests and info are logged.
My Thoughts are:
- Check the logs, get the client IP and block them on the firewall
- If this is not slowing down or stopping the attacker/s, ie a coordinated attack with several attackers, take the site and server offline for a temporary amount of time
Is there any other recommended action or best practice?