Incidence Response & Computer Forensics, Second Edition Chris Prosise Kevin Mandia

Outline After Detection of an Incident Overview of the initial response phase Establishing an incident notification procedure Recording the details after initial detection Incident declaration Assembling the CSIRT Performing traditional investigative steps Conducting interviews Formulating a response strategy

Incident Response methodology Pre-Incident Preparation Initial Response Formulate Response Strategy Detection of Incidents Investigate the Incident Data Collection Data Analysis Reporting Resolution Recovery Implement Security Measures Incident Occurs: Point-In-Time or Ongoing

Overview of the initial response phase Incident Detection Initial Notification of Incident Record Details Incident Declaration Assembling The CSIRT Escalation Notification of Team Members Selecting Team Members Incident Occurs: Point-In-Time or Ongoing

Recording the details after initial detection Initial Response Checklist First Section of the initial Response Checklist Second Section of the Initial Response Checklist System details Incident containment Preliminary investigation Case Notes

First Section of the initial Response Checklist Date the incident was detected or initiated Contact information of person completing the form Contact information of the person who detected the incident The type of incident The location(s) of the computers affected by the incident The date the incident was first noticed A description of the physical security at the location(s) How the incident was detected Who accessed or touched the relevant system(s) since the onset of the incident Who has had physical access to the affected system(s) since the onset of the incident Who current knows about the incident

Second Section of the Initial Response Checklist System details Make and model of the relevant system(s) Operating system Primary user of the system(s) System administrator for the system(s) Network address or IP address of the relevant system(s) Network name of the system(s) Whether there is a modem connection to the system(s) Critical information that may have resided on the system(s) Incident containment Whether the incident is in progress or ongoing Whether network monitor is needed or being conducted The system is still connected to the Internet/network

Second Section of the Initial Response Checklist Whether the backup tapes exist for the relevant systems Whether there is a requirement to keep knowledge of the incident on a “ need-to-know ” basis. Whether any remedial steps have been taken so far Whether the information collected is being stored in a protected, tamper-proof manner. Preliminary investigation The IP addresses involved in the incident Whether any investigative steps or actions have already been taken Whether a forensic duplication need to be made, or a logical copy of the relevant system(s) will suffical

Incident Declaration Was there a scheduled system or network outage that caused resources to be unavailable during the time the incident was reported? Was there an unscheduled and unreported outage of network service provider that caused resources to be unavailable during the time the suspected incident was reported? Was the affected system recently upgraded, patched, reconfigured, or otherwise modified in such a way as to cause the suspicious activity that was reported? Was testing being performed on the network that would lock out accounts or cause resource to be unavailable? For inside incidents, are there any justifications for the actions an employee has taken that remove or lessen the suspicious?

NextTime Assembling the CSIRT Performing traditional investigative steps Conducting interviews Formulating a response strategy