BestHub
Sign in
Tagged articles

incident response

242 articles · Page 3 of 3
Meituan Technology Team
Meituan Technology Team
Nov 8, 2018 · Information Security

Intrusion Detection: Concepts, Challenges, and Best Practices

Effective intrusion detection for large enterprises hinges on combining signature‑based pattern matching with baseline anomaly modeling, gathering comprehensive host and network logs, focusing on the GetShell foothold, managing alert fatigue, and integrating AI‑enhanced feature engineering while maintaining robust operational foundations and continuous expertise development.

AISecurity Operationscybersecurity
0 likes · 31 min read
Intrusion Detection: Concepts, Challenges, and Best Practices
dbaplus Community
dbaplus Community
Sep 12, 2018 · Operations

Mastering Enterprise Ops Security: Habits, Architecture, and Incident Response

This article presents a comprehensive guide to operational security, covering essential habits, a layered technical architecture, access‑control strategies, CI/CD safeguards, DDoS mitigation, data protection, incident‑response procedures, and collaboration with IT, security, and network teams.

CI/CD securityDDoS DefenseOps Security
0 likes · 20 min read
Mastering Enterprise Ops Security: Habits, Architecture, and Incident Response
Beike Product & Technology
Beike Product & Technology
Aug 15, 2018 · Information Security

Malware Incident Response: Analyzing and Removing a Persistent Windows Trojan

This article details a step‑by‑step incident‑response case study of a Windows internal‑network Trojan that exploited SMB port 445, describing how alerts were identified, malicious processes were traced, terminated, and fully removed using tools such as netstat, PChunter, and process monitoring utilities.

Malware AnalysisWindows securityincident response
0 likes · 6 min read
Malware Incident Response: Analyzing and Removing a Persistent Windows Trojan
Efficient Ops
Efficient Ops
Jul 8, 2018 · Operations

How to Seamlessly Take Over New Ops Responsibilities: A Practical Checklist

This guide outlines a step‑by‑step approach for taking over new operational responsibilities, covering communication with development leaders, business overview, asset inventory, basic and business‑specific monitoring, standardization, SOP creation, failure drills, cost and capacity planning, and effective cross‑team communication.

Asset ManagementMonitoringOperations
0 likes · 10 min read
How to Seamlessly Take Over New Ops Responsibilities: A Practical Checklist
MaGe Linux Operations
MaGe Linux Operations
Jul 7, 2018 · Operations

How to Seamlessly Take Over a New Service: An Operations Playbook

This guide outlines a step‑by‑step operations playbook for assuming responsibility of a new business service, covering initial communication, asset inventory, monitoring setup, standardization, SOP creation, incident drills, ongoing optimization, and effective cross‑team communication to ensure stable, low‑cost, and high‑quality service delivery.

Asset ManagementMonitoringSOP
0 likes · 9 min read
How to Seamlessly Take Over a New Service: An Operations Playbook
ITPUB
ITPUB
Apr 21, 2018 · Operations

Essential Ops Checklist: Avoid Disasters with Proven Practices

A seasoned operations engineer shares a comprehensive guide covering online operation standards, data handling, security hardening, daily monitoring, performance tuning, and the right mindset to prevent costly incidents and ensure stable, secure, and efficient production environments.

Monitoringincident response
0 likes · 14 min read
Essential Ops Checklist: Avoid Disasters with Proven Practices
Java Backend Technology
Java Backend Technology
Apr 2, 2018 · Information Security

How a Hidden Cron Job Hijacked My Server and How I Fixed It

A production server running Tomcat, MySQL, MongoDB and ActiveMQ was taken down by a malicious cron job that executed a cryptomining script, and the article walks through the investigation, removal, and hardening steps to fully recover and secure the system.

Linux Hardeningcron jobcryptomining
0 likes · 4 min read
How a Hidden Cron Job Hijacked My Server and How I Fixed It
Alibaba Cloud Infrastructure
Alibaba Cloud Infrastructure
Dec 21, 2017 · Operations

Stability Monitoring Practices for Double 11 2017

The 2017 Double 11 stability monitoring project introduced a four‑layer monitoring architecture—including customer & sentiment, business, system water‑level, and infrastructure monitoring—along with data archiving and system‑level reliability measures to detect, respond to, and mitigate issues far faster than traditional manual processes.

MonitoringOperationsbig-data
0 likes · 14 min read
Stability Monitoring Practices for Double 11 2017
21CTO
21CTO
Nov 2, 2017 · Operations

How to Diagnose and Fix Online System Issues Efficiently

This article shares practical methods for frontline engineers to quickly understand, assess, and resolve online system problems by categorizing system layers, evaluating impact, using essential Linux monitoring tools, and applying systematic troubleshooting and design‑for‑failure strategies to minimize downtime.

Linux toolsOnline Debuggingbackend operations
0 likes · 11 min read
How to Diagnose and Fix Online System Issues Efficiently
dbaplus Community
dbaplus Community
Sep 21, 2017 · Information Security

How I Detected and Fixed a Shellshock Attack on a Linux Server

After a sudden server crash, the author traced a ransomware note, uncovered a Bash Shellshock exploit through log analysis and crafted GET requests, verified the vulnerability, upgraded Bash, and applied post‑compromise hardening steps to fully recover the system.

Bash vulnerabilityShellshockincident response
0 likes · 11 min read
How I Detected and Fixed a Shellshock Attack on a Linux Server
MaGe Linux Operations
MaGe Linux Operations
Jul 20, 2017 · Information Security

Essential Linux Security Hardening: From Account Safety to Rootkit Detection

This guide outlines comprehensive Linux security practices for administrators, covering account and login protection, service minimization, password and key authentication, sudo usage, system welcome message hardening, remote access safeguards, filesystem permissions, rootkit detection tools, and step‑by‑step response procedures after a server compromise.

Rootkit Detectionincident responselinux-security
0 likes · 25 min read
Essential Linux Security Hardening: From Account Safety to Rootkit Detection
21CTO
21CTO
Jul 10, 2017 · Operations

How I Rescued a Production MySQL Database After a Fatal rm -rf Disaster

After a mistaken rm -rf command wiped an entire production server—including MySQL data—the author chronicles a step‑by‑step recovery using ext3grep, custom scripts, and binlog restoration, highlighting lessons learned and best practices for future incident handling.

BackupData RecoveryLinux
0 likes · 9 min read
How I Rescued a Production MySQL Database After a Fatal rm -rf Disaster
Efficient Ops
Efficient Ops
Apr 13, 2017 · Information Security

From Traditional Ops to Automated Security: Ctrip’s Journey and Lessons

This article recounts a Ctrip security engineer’s evolution from early Unix‑based operations to fully automated network security, highlighting challenges in forecasting, application security integration, rapid incident response, and large‑scale firewall automation within a fast‑growing enterprise.

AutomationSecurity Operationsincident response
0 likes · 12 min read
From Traditional Ops to Automated Security: Ctrip’s Journey and Lessons
MaGe Linux Operations
MaGe Linux Operations
Mar 24, 2017 · Information Security

How We Detected and Eliminated a Struts2 Mining Malware Attack

This article recounts a recent incident where a Struts2 vulnerability was exploited to run mining malware, detailing the discovery process, forensic analysis of services, processes, network listeners, and the step‑by‑step remediation measures including script‑based scans, permission hardening, and upgrading Struts2.

Struts2Vulnerabilityincident response
0 likes · 4 min read
How We Detected and Eliminated a Struts2 Mining Malware Attack
Efficient Ops
Efficient Ops
Feb 28, 2017 · Operations

Prepare Your E‑Commerce System for Mega‑Sales: Proactive Prevention & Rapid Response

This article outlines a comprehensive PDCA‑based methodology for e‑commerce platforms to proactively prevent issues, quickly detect anomalies, and execute rapid decisions during large‑scale promotions, covering system goal definition, performance evaluation, capacity planning, SLA management, and team/process maturity.

MonitoringOperationscapacity planning
0 likes · 18 min read
Prepare Your E‑Commerce System for Mega‑Sales: Proactive Prevention & Rapid Response
MaGe Linux Operations
MaGe Linux Operations
Feb 26, 2017 · Information Security

How We Traced and Stopped a UDP Flood Attack on an Oracle‑Tomcat Server

During the Chinese New Year a client’s Oracle‑Tomcat server was overwhelmed by massive UDP traffic, prompting a forensic investigation that uncovered a hidden Trojan, detailed command‑line analysis, iptables hardening, and the root cause of a weak SSH password left after a hardware upgrade.

Linux forensicsMalware AnalysisSSH security
0 likes · 5 min read
How We Traced and Stopped a UDP Flood Attack on an Oracle‑Tomcat Server
Efficient Ops
Efficient Ops
Feb 20, 2017 · Information Security

Inside YY's Security Ops: Real-World Incident Stories and Architecture

This article shares YY's security operations journey, detailing real incident response scenarios, the evolution of their security infrastructure from 2012 onward, and the key factors considered when building a robust security ops system, including DDoS protection, WAF, vulnerability scanning, intrusion detection, and data‑driven automation.

DDoS protectionSecurity Operationsbig data analytics
0 likes · 24 min read
Inside YY's Security Ops: Real-World Incident Stories and Architecture
Efficient Ops
Efficient Ops
Feb 16, 2017 · Operations

Why a Missed DNS Renewal Shut Down Our Site—and How We Fixed It

A detailed post‑mortem recounts how a forgotten domain renewal caused a DNS outage, the frantic troubleshooting steps across teams, temporary work‑arounds like switching to Google DNS, and the lessons learned for future incident management.

DNSdomain managementincident response
0 likes · 13 min read
Why a Missed DNS Renewal Shut Down Our Site—and How We Fixed It
21CTO
21CTO
Feb 2, 2017 · Operations

What GitLab’s 300 GB Data Loss Teaches About Backup and Ops Discipline

The GitLab production database was mistakenly deleted during a manual fix, exposing gaps in backup strategies, PostgreSQL configuration, and operational practices, and prompting a detailed post‑mortem that highlights the need for automated recovery, proper tooling, and transparent incident handling.

Data lossOperationsPostgreSQL
0 likes · 15 min read
What GitLab’s 300 GB Data Loss Teaches About Backup and Ops Discipline
dbaplus Community
dbaplus Community
Jan 25, 2017 · Information Security

Effective Server Security Incident Response: Step‑by‑Step Guide

When a production server is compromised, abrupt actions like pulling the plug can disrupt services, so this guide outlines an eight‑stage, evidence‑driven response process—including verification, on‑site preservation, containment, impact assessment, online analysis, backup, deep forensics, and reporting—plus real‑world case studies and concrete command examples.

Case studyLinuxforensics
0 likes · 14 min read
Effective Server Security Incident Response: Step‑by‑Step Guide
ITPUB
ITPUB
Jan 17, 2017 · Information Security

How to Diagnose and Eradicate a Linux Trojan That Spikes Outbound Traffic

This article recounts a real‑world incident on an Ubuntu 12.04 server where massive outbound traffic was traced to a hidden trojan, detailing step‑by‑step investigation, identification of malicious processes, removal techniques, and preventive hardening measures.

Rootkitincident responseiptables
0 likes · 9 min read
How to Diagnose and Eradicate a Linux Trojan That Spikes Outbound Traffic
Nightwalker Tech
Nightwalker Tech
Nov 9, 2016 · Operations

Best Practices for Service Monitoring and Alerting in E‑commerce Systems

The discussion outlines essential service‑monitoring techniques—including health checks, JVM metrics, traffic and payment ring‑ratio analysis, client‑side exception tracking, third‑party CDN monitoring, alert thresholds, instrumentation via AOP or SDKs, and tooling such as Datadog, Zabbix, and the Elastic stack—to reliably detect and respond to incidents in e‑commerce environments.

Monitoringalertinge-commerce
0 likes · 10 min read
Best Practices for Service Monitoring and Alerting in E‑commerce Systems
360 Zhihui Cloud Developer
360 Zhihui Cloud Developer
Oct 14, 2016 · Operations

Mastering Rapid Incident Response: An Ops Engineer’s 4‑Step Method

This guide teaches operations engineers a four‑step “Wang‑Wen‑Wen‑Qie” methodology—observing system health, listening via alerts, questioning changes, and pulse‑checking with profiling tools—to rapidly diagnose and resolve high‑impact incidents while maintaining clear communication and post‑mortem learning.

MonitoringOperationsincident response
0 likes · 5 min read
Mastering Rapid Incident Response: An Ops Engineer’s 4‑Step Method
ITPUB
ITPUB
Sep 21, 2016 · Operations

How Tencent Cloud Recovered Lost Data in a 2‑Day Storage Crisis

In a two‑day incident, Tencent Cloud's CBS team diagnosed cell failures, implemented directed reads and a dual‑cell merge strategy, and restored three‑copy data integrity, while uncovering monitoring gaps and tool limitations that inform future storage operations.

Cloud StorageData Recoverydistributed storage
0 likes · 9 min read
How Tencent Cloud Recovered Lost Data in a 2‑Day Storage Crisis
MaGe Linux Operations
MaGe Linux Operations
Sep 20, 2016 · Information Security

Step‑by‑Step Guide to Investigating a Compromised Linux System

Learn how to systematically examine a Linux host for compromise by checking logs, user accounts, processes, file integrity, network activity, scheduled tasks, services, and rootkits, using built‑in commands and RPM verification to uncover hidden threats.

LinuxRootkit DetectionSystem Security
0 likes · 5 min read
Step‑by‑Step Guide to Investigating a Compromised Linux System
Efficient Ops
Efficient Ops
Sep 13, 2016 · Operations

How Google SRE Principles Compare Across Industries

This article, excerpted from the upcoming Chinese edition of “SRE: Google Site Reliability Engineering”, examines how Google’s SRE guiding philosophies—disaster planning, post‑mortem culture, automation, and data‑driven decision‑making—are adopted, adapted, or contrasted in sectors such as manufacturing, aerospace, nuclear, telecommunications, healthcare, and finance, highlighting key similarities, differences, and lessons for Google and the broader tech industry.

AutomationOperationsSRE
0 likes · 21 min read
How Google SRE Principles Compare Across Industries
Efficient Ops
Efficient Ops
May 30, 2016 · Information Security

Why Weak Passwords and Unpatched Redis Threaten Operational Security

The article explains how weak passwords, misconfigured services like Redis, careless port changes, and leaked data enable attackers to compromise servers and internal networks, illustrating each risk with real‑world case studies and offering practical mitigation advice for robust ops security.

Redis vulnerabilitydata breachincident response
0 likes · 11 min read
Why Weak Passwords and Unpatched Redis Threaten Operational Security
dbaplus Community
dbaplus Community
May 27, 2016 · Databases

How to Keep DBA Operations Error‑Free: 5 Essential Practices

This article shares practical DBA advice—pre‑operation preparation, thorough fault analysis, effective communication, mandatory backups, and post‑incident reviews—to help database administrators maintain stability and avoid costly mistakes during online operations.

DBAbest practicesincident response
0 likes · 7 min read
How to Keep DBA Operations Error‑Free: 5 Essential Practices
MaGe Linux Operations
MaGe Linux Operations
Apr 29, 2016 · Information Security

How to Analyze and Recover from a Linux Rootkit Intrusion

This article walks through a real-world Linux server compromise, detailing the attack symptoms, forensic analysis steps, rootkit discovery, exploitation of an Awstats script vulnerability, and practical remediation measures to restore and harden the affected system.

AwstatsLinuxRootkit
0 likes · 14 min read
How to Analyze and Recover from a Linux Rootkit Intrusion
Efficient Ops
Efficient Ops
Dec 16, 2015 · Operations

Mastering Ops Team Communication and Process Standards for Effective Management

This article outlines practical communication techniques, environment choices, active listening, and emotional control for operations teams, then details how to define standards, build robust processes, and ensure reliable business continuity through clear responsibilities, monitoring, automation, and continuous improvement.

Process Standardsincident responseoperations best practices
0 likes · 11 min read
Mastering Ops Team Communication and Process Standards for Effective Management
ITPUB
ITPUB
Nov 16, 2015 · Information Security

5 Hidden Signs Your Web Application Is Compromised and How to Respond

The article outlines five subtle indicators of a web application breach—abnormal behavior, irregular logs, unexpected processes or users, file modifications, and warning messages—while offering practical monitoring and remediation steps to help security teams detect and mitigate attacks early.

application monitoringincident responselog analysis
0 likes · 7 min read
5 Hidden Signs Your Web Application Is Compromised and How to Respond
Efficient Ops
Efficient Ops
Jul 6, 2015 · Operations

How to Tame “Thorny” Employees Without Undermining Your Ops Team

This article explores the characteristics, causes, and practical strategies for managing difficult or “thorny” team members in operations, offering case studies and step‑by‑step recommendations to mitigate risks while maintaining team performance.

employee performanceincident responseleadership
0 likes · 9 min read
How to Tame “Thorny” Employees Without Undermining Your Ops Team
MaGe Linux Operations
MaGe Linux Operations
Apr 24, 2015 · Operations

10 Proven Fault Management Practices Every Ops Team Should Master

This guide shares ten practical fault‑management techniques—ranging from proactive attitude and prioritizing incidents to continuous follow‑up and team collaboration—to help operations teams reduce damage, maintain service reliability, and keep users engaged during outages.

Operationsbest practicesfault management
0 likes · 8 min read
10 Proven Fault Management Practices Every Ops Team Should Master
MaGe Linux Operations
MaGe Linux Operations
Aug 19, 2014 · Operations

Essential Linux Security Checklist: 11 Steps to Detect Compromise

This guide provides a comprehensive 11‑step Linux security inspection checklist, covering account verification, log analysis, process and file checks, package integrity, network monitoring, scheduled tasks, backdoor detection, kernel modules, services, and rootkit scanning to help identify system compromises.

Linux commandsOperationsincident response
0 likes · 5 min read
Essential Linux Security Checklist: 11 Steps to Detect Compromise