I have worked in a startup myself as the lone IT & Sec guy for quite sometime. Generally the attitude towards securing one's IP, Infrastructure, etc is lax atle

I have worked in a startup myself as the lone IT & Sec guy for quite sometime. Generally the attitude towards securing one's IP, Infrastructure, etc is lax atleast in the beginning days and comes into focus if something nasty happens. My inputs wrt second scenario. 1. Try and figure out from the log as to what changes were made. 2. Take a backup 3. Ask your employees if anyone indeed logged in from that suspicious remote IP (You never know if any of your employees used a proxy, etc.....) 4. Review the permissions given and harden as necessary. Change Credentials 5. If cost is a constraint, there are plenty of open source utilities/applications that can be used for relatively lower costs than the ones from the big companies 6. If something as important as Intellectual Property, Sensitive information is stolen, I guess you are obligated to inform LEA & make a disclosure. 7. Mistakes happen! 8. Document everything!!! I had an experience where a rogue dhcp server popped into our LAN from nowhere! Fortunately I had documented every systems MAC address in our LANs previously and was able to identify the rogue machine and also created a blog post on the same. you can read here: http://virtualthoughts.org/2006/best-practices-network-outages-and-resolutions/ http://virtualthoughts.org/2006/best-practices-network-outag...