Saltar al contenido principal
CargarIdioma (ES)Atención al cliente
EmpresarialesMóvilRedes socialesMarketingTecnologíaArte y fotografíaEmpleoDiseñoEducaciónPresentaciones y charlas públicasGobierno y org. sin ánimo de lucroAtención sanitariaInternetDerechoLiderazgo y gestiónMotorIngenieríaSoftwareReclutamiento y RR. HH.Venta al por menorVentasServiciosCienciasPYMES y liderazgoAlimentaciónMedio ambienteEconomía y finanzasDatos y análisisRelaciones con inversoresDeportesMeditaciónNoticias y políticaViajesDesarrollo personalSector inmobiliarioEntretenimiento y humorSalud y medicinaDispositivos y hardwareEstilo de vida
Sam Bowne, profile picture
Subido porSam Bowne
PDF, PPTX2,003 vistas

CNIT 121: 2 IR Management Handbook

This document discusses the roles and responsibilities involved in incident response (IR). It describes the incident manager who leads the investigation team, and the remediation team leader who coordinates remediation activities. It outlines the IR process including initial response, investigation, and remediation phases. It provides guidance on hiring IR talent, preserving evidence, analyzing data, developing indicators of compromise, and creating reports.

Educación◦
Descargar como PDF, PPTX
CNIT 121: Computer Forensics 2 IR Management Handbook
What is a Computer Security Incident?
Examples
Goals of IR
Incident Manager • Leads the investigation team • Must be able to get information and request actions quickly • Often the CIO, CISO, or someone they directly appoint to work on their behalf
Remediation Team Leader • Experienced member of IT staff • Focal point for all remediation activities, including • Corrective action • Evaluating the sensitivity of stolen data • Strategic changes that will improve the orgqaniations security posture
Ancillary Teams
PCI-DSS
Finding IR Talent • Cost of maintaining an IR team • Culture of outsourcing • Mandated by regulatory or certification authorities • Inexperience in investigations • Lack of or limited in-house specialization
How to Hire IR Talent • Finding candidates • Already working on other IR teams • Online IR social networking sites • College programs in computer science, engineering, or computer forensics • Preferably post-graduate
How to Hire IR Talent • Assessing the Proper Fit: Capabilities and Qualities • Experience in running investigations involving technology • Experience in performing computer forensics examinations • Experience in network traffic analysis • Knowledge of applications relevant to your organization
IR Team Member Characteristics
Industry Certifications • Certs requiring periodic retesting and demonstration of continuing education • Too many certs indicate shallowness
The Incident Response Process
Three Main Activities
Initial Response • Assemble the response team • Review network-based and other readily- available data • Determine type of incident • Assess potential impact
Common Tasks
Investigation • Goal is to determine • What happened • How it happened • Sometimes, who was responsible • Simply re-imaging servers without this knowledge is uncertain and risky
Don't Act too Quickly • Jumping into remediation without all the facts is risky • Attacker may detect your remediation and dig in deeper • Usually better to gather more complete information to plan a more complete remediation action
Initial Leads • Don't focus exclusively on malware • Once attacker has a foothold and gathers credentials, he no longer needs malware • Good leads are • Relevant to current incident • Detailed -- with IP addresses, date & time, etc. • Actionable - you have logs that can be followed
Indicators of Compromise (IOC) Creation • Working directory names • Output file names • Login events • Persistence mechanisms • IP addresses • Domain names • Malware network protocol signatures
IOC Formats
Example IOC • Link Ch 2a
IOC Deployment • Find compromises in an automated fashion with • Enterprise IR platform • Visual Basic scripts • Windows Management Instrumentation (WMI) scripts
IOC Formats • For network signatures, Snort rules are the standard • There are three IPC formats, but none has emerged as the clear leader and an industry standard yet
Identify Systems of Interest • After deploying IOCs, you find "Hits" • A match for a rule or IOC • Review matching information to see if the hit is valid • Hits can be false positives
Initial Triage • Validate • Check time frame and other data to make sure the matching item is relevant • Categorize • Assign systems to meaningful categories like "Backdoor installed", "Access with valid credentials", "SQL injection", "Credential harvesting", or "Data theft" • Prioritize • Highest priority given to machines that offer new investigative leads, such as a different backdoor
Preserve Evidence • Minimize changes to a system • Minimize interaction time with a system • Create appropriate documentation • Can collect evidence from a running system or take it down for imaging • Don't collect large volumes of data that may never be examined
Evidence Preservation Categories • Live response • Most common method • Use an automated tool to collect standard data from a running system • Contains volatile and nonvolatile information • Process list, active network connections, event logs, a list of objects in the file system, registry • Contents of log files and suspected malware
Evidence Preservation Categories • Memory collection • Most useful when the attacker is hiding activities, such as a rootkit, and you cannot obtain a disk image • Useful for memory-resident malicious activity • Not worth the bother on most systems, because there's not enough data to answer high-level questions • No way to explain how malware got there, or what the attacker has been doing
Evidence Preservation Categories • Forensic Disk Image • Complete duplicate of a hard disk • Images are large and take a long time to analyze • Only worth it if necessary; such as when the attacker performed many actions over a long time, or where information is required that can't be found elsewhere • If no intrusion is suspected, a disk image is the norm
Analyze Data • Malware analysis • Live response analysis • Forensic examination (on disk images) • Make a list of realistic questions to answer • Don't allow time to be wasted here
Remediation • Remediate when detection methods stop finding new events ("steady state") • Start planning remediation early in the IR process • There are many moving parts to any organization • Coordinating threat removal is not an easy task
Three Activities
Posturing • Steps that ensure the success of remediation • Establishing protocol • Exchanging contact information • Designating responsibilities • Increasing resources • Scheduling resources and coordinating timelines
Tactical • Actions to address the current incident • Rebuilding compromised systems • Changing passwords • Blocking IP addresses • Informing customers • Making internal or public announcement • Changing a business process
Strategic • Long-term improvements • May require significant changes within an organization
Tracking Significant Investigative Information • Track critical information • And share it with ancillary teams and organization's leadership • Incident numbering or naming system
Significant Investigative Information • List of evidence collected • With date, time, source, and chain of custody • List of affected systems • List of files of interest • List of accessed or stolen data
Significant Investigative Information • List of significant attacker activity • List of network-based IOCs • List of host-based IOCs • List of compromised accounts • List of ongoing and requested tasks for your teams
Reporting • Reports are fundamental deliverables for consultants • Periodic, formal report keep track of all the finding and keep the investigation focused • Writing the report helps you organize your activities