BCP 55

RFC 3227

Guidelines for Evidence Collection and Archiving, February 2002

File formats:
icon for text file icon for PDF icon for HTML
Status:
BEST CURRENT PRACTICE
Authors:
D. Brezinski
T. Killalea
Stream:
IETF
Source:
grip (ops)

Cite this RFC: TXT  |  XML  |   BibTeX

DOI:  https://doi.org/10.17487/RFC3227

Discuss this RFC: Send questions or comments to the mailing list iesg@ietf.org

Other actions: View Errata  |  Submit Errata  |  Find IPR Disclosures from the IETF  |  View History of RFC 3227


Abstract

A "security incident" as defined in the "Internet Security Glossary", RFC 2828, is a security-relevant system event in which the system's security policy is disobeyed or otherwise breached. The purpose of this document is to provide System Administrators with guidelines on the collection and archiving of evidence relevant to such a security incident. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.


For the definition of Status, see RFC 2026.

For the definition of Stream, see RFC 8729.




Advanced Search