One discussion I didn't see in the earlier NYT hack discussion (http://news.ycombinator.com/item?id=5143046 http://news.ycombinator.com/item?id=5143046) was wha

One discussion I didn't see in the earlier NYT hack discussion (http://news.ycombinator.com/item?id=5143046 http://news.ycombinator.com/item?id=5143046) was what current best practices/readily available tools are for containing/detecting attacks, from the perspective of running a corp network/startup service, and as an end-user when faced w/ APT-level attacks? For those deep in the trenches, is there a good resource for getting started for those technically inclined/interested in learning more? Presumably there are basic things like proper firewalls and MFA, but also more advanced things like pattern/anomaly detecting IDS's or traffic monitoring tools? On the user side, are there smarter ways for detecting when your system is RAT infested (seems like a IDS running on your laptop should be able to notify you if you're system is sending out a new VNC/IRC connection...) Back when I was more into system/network security, the open source tools (Tripwire, AIDE, Snort) were all ... rather manual/labor intensive. Have things evolved as the sheer amount of attacks/attack vectors have increased?