Chapter 2 Incident Response Management Handbook Spring Incident Response & Computer Forensics

What is a Computer Security Incident?  An event  Intended for causing harm  Performed by a person (i.e., not due to factors beyond one’s control)  Involves a computing resource Examples  Data theft  Theft of funds  Extortion  Unauthorized access  Presence of malware  Possession of illegal or unauthorized materials

Goals of Incident Response  Remove threats  Minimize damages  Restore normal operations quickly

Who is Involved in IR Process?  HR  IT  Legal  Business line managers  Network infrastructure  Compliance  Core investigative team

IR Process  Initial Response  Investigation  Remediation

Initial Response  Assemble the response team  Review readily available data  Determine the type of incident  Assess the potential impact

Investigation  What? How? Who? etc.  Start with initial leads  Identify systems of interest  Preserve evidence  Live response  Memory collection  Forensic disk image  Analyze data  Malware analysis  Live response analysis  Forensic examination

Remediation  Consider all aspects  Legal, business, political, technical, etc.  Time is critical  Too soon - may fail to discover some important information  Too late – may increase the damage

Reporting  Very important step  From legal and other viewpoints  Also help stay focused and perform quality investigations