Fermi Computer Incident Response Team Computer Security Awareness Day March 8, 2005 Michael Diesburg

What Is FCIRT? FCIRT – Fermi Computer Incident Response Team –Group of computing experts who investigate compromised systems and guide cleanup –On call 24x7 –FCIRT does not make policy. Their concern is with understanding how a compromise occurred and what actions are necessary to restore the system to production –Think of it as a volunteer fire department

When Should You Contact FCIRT? Any time you suspect a system has been hacked or infected with a virus. For any issues of unauthorized usage. Anytime you suspect a machines usage is not in accordance with the rules of acceptable usage. If in doubt, contact us

How To Contact FCIRT Normal contact is via Mail list is monitored on regular basis during normal working hours. Some delay in response after hours or on weekends You may also contact Helpdesk For urgent issues call:

How FCIRT Operates FCIRT actions have several goals: –Contain any damage –Determine how compromise occurred –Oversee the cleanup of compromised systems and certify cleaned systems to be returned to normal use –Assess how compromise could have been avoided

How FCIRT Operates Upon alert, FCIRT personnel first triage the suspected incident: –No incident –SMOKE - Further investigation required. Minor incident to be handled by local system managers under oversight of FCIRT –FIRE – Major incident. FCIRT assumes full administrative control of the systems involved.

How FCIRT Operates SMOKE –A SMOKE is declared if there is evidence that some compromise may have occurred and further investigation is required –If investigation shows problem is confined to single system with limited impact on users, then cleanup is usually delegated to system managers –Incidents which may have widespread impact may be elevated to FIREs

How FCIRT Operates SMOKE –Covers things like well common viruses whose infection vector is well known. –Normal procedure: Use AV cleaning tools Or re-install form known good media. Make sure all patches are up to date Scan all files with latest AV signatures Make sure node and all NICs are registered Return to service

How FCIRT Operates FIRE –A FIRE is declared when incident involves major servers, impacts many users, or in any way adversely effects the mission of the lab. –FCIRT takes complete control of systems in these cases –May involve removal form network, or in some cases even confiscation of equipment

How FCIRT Operates FIRE –First action is to contain the damage. Either via network block or by physically removing the system from network. –State of the system is then examined to determine how the compromise occurred Weak passwords Known vulnerabilities Pilot error

How FCIRT Operates FIRE –Network records are examined to determine what other systems may have been involved –Determination is made as to what must be done to protect the system from compromise –Copies of disks may be made at the request of government authorities –System is cleaned and returned to service

How FCIRT Operates Reporting –Any computing incident also triggers several reporting streams –In case of a FIRE, the relevant system managers, division heads, and CSExec are notified –In some instances appropriate government agencies will be informed –Daily reports are made to the above until the incident is closed