| If you detect a break-in, document the time of the intrusion, all information from the log files, and any changes made to data. Report the incident. There are several organizations that help victims with network intrusions, including the Computer Emergency Response Team www.cert.org the Forum of Incident Response and Security Team www.first.org the US Dept of Energy's Computer Incident Advisory Capability ciac.llnl.gov The affected host should be restored or completely rebuilt and all systems on the network should be examined to identify the hole that allowed the intrusion.