Outlines a structured approach to manage and mitigate security incident effectively.
Minimize impact of security breaches.
Reduce response time.
Hasten recovery.
Incident Response Process
Incident: Act of violating an explicit or implied security policy.
Seven Stages:
Preparation: Strengthening systems and networks to resist attacks.
Detection: Identifies security incidents. We move on once we have triaged and categorized the incident.
Analysis: Thorough examination and evaluation of incident. Understand scope, impact, and potential consequences. Stakeholders informed, containment begins, initial response actions taken.
Containment: Limit incident’s impact by securing data and protecting business operations.
Eradication: Aims to remove malicious activity from system/network.
Recovery: Restore systems and services to secure state. Often involves restoring to known-good backup, installing security patches, and implementing configuration updates.
Post-incident activity/Lessons learned: Happens after containment, eradication, and full recovery.
Root cause analysis: Identifies incident’s source and how to prevent it in the future.
Lessons learned process: Documents experiences during incidents in a formalized way.
After-action report: Collects formalized information about what occurred.
Threat Hunting
Cybersecurity method for finding hidden threats not caught by regular security monitoring.
Steps:
Establish a hypothesis: Predict high-impact, likely events through threat modeling.
Profiling Threat Actors and Activities: Envision how potential attackers might intrude and what they aim to achieve.
Analyze: Analyze logs and data on processes, file systems, and server changes to gather information.
Threat Hunting v. Standard Detection:
Normal sensors work at detecting known threats; threat hunting is about finding undetected issues, things that bypass existing rules, and cases where queries do not yield expected data.
Root Cause Analysis
Systematic process to identify initial source of an incident and how to prevent it from occurring again. Make sure this process uses a no-blame approach, the goal is find out what occurred to cause the incident.
Incident Response Training and Testing
Training: Ensures staff grasp processes and priorities for incident response.
Testing: Practical exercise of incident response procedures.
Tabletop Exercise (TTX): Exercises simulate incidents within a control framework.
Pentest: Simulates network intrusion based on threat scenarios.
Simulation: Replicates real incidents for hands-on experience.
Digital Forensic Procedures
Process of investigating and analyzing digital devices and data to uncover evidence for legal disputes. Should always adhere to organization’s procedures.
Phases:
Identification: Ensures safety of scene, secures it to prevent evidence contamination, and determines the scope of the evidence to be collected.
Collection: Process of gathering, preserving, and documenting physical or digital evidence in various fields.
Order of Volatility: Dictates sequence data sources should be collected and preserved based on their susceptibility to modification or loss.
Chain of Custody: Documented and verifiable record that tracks the handling, transfer, and preservation of digital evidence from the moment it is collected until it is presented in a court of law.
Disk Imaging: Creating bit-by-bit or logical copy of a storage device.
File Carving: Extracting files and data fragments from storage media without relying on the file system.
Analysis: Systematically scrutinizing data to uncover relevant information such as potential signs of criminal activity, hidden files, timestamps, and user interactions.
Reporting: Documenting findings, processes, and methodologies used during a digital forensic investigation.
Legal Hold: Formal notification that instructs employees to preserve all potentially relevant electronic data, documents, and records.
Electronic Discovery: Process of identifying, collecting, and producing electronically stored information during potential legal proceedings.
Forensic analysts must adhere to a code of ethics that maintains:
Avoiding bias
Repeatable actions
Preservation of evidence
Data Collection Procedures
Standard forensic data collection procedures to remember:
Capture RAM (Memory).
Capture a bit-by-bit disk image of the storage drive.
Utilize forensic tools such as Forensic Toolkit (FTK) or EnCase.
Capture screenshots of the machine.
Always follow the order of volatility when collecting evidence.
Collect statements from witnesses and administrators.
Review licensing and documentation for all systems.
Track man hours and billing.
Data Acquisition: Method and tools used to create a forensically sound copy of the data from a source device, such as system memory or a hard disk.
Order of Volatility:
CPU registers and cache memory
System memory, routing tables, ARP caches, process table, temporary swap files