1. WINDOWS FORENSICS FOR INCIDENT RESPONSE CHRISTIAN KOPACSI CISSP CISM CEH CHFI SECURITY+

2. WHAT IS INCIDENT RESPONSE An organized approach to addressing and managing the aftermath of a security breach or attack.

3. STEPS TO SUCCESS

4. PURPOSE OF INCIDENT RESPONSE  Preparation  User Awareness  Detection & Analysis  Did an incident occur  Containment  Prevent further damage  Eradication  Root cause analysis  Recovery  Reimage the affected workstation  Post Incident Activity  Lessons Learned

5. PREPARATION  User Awareness & Training

6. SOCIAL ENGINEERING

7. DETECTION & ANALYSIS  You can’t Respond if you can’t Detect  Logs – Hopefully a SIEM  Workstation \ Server  Firewall  IDS \ IPS  Internet Proxy \ Filter  MSSP \ 3 rd Party  End Users \ Customers  You!

8. CONTAINMENT  Prevent Further Damage  NAC  ACL  Firewall  Switch  Software  Application Whitelisting  AV

9. ERADICATION  Root Cause Analysis  Make Sure Problem Does Not Come Back!

10. RECOVERY  Known Good Configuration  Reimage Device  Restore from Backup

11. POST INCIDENT ACTIVITY  Lessons Learned  What Worked  What Didn’t Work  New Policy \ Procedures  Change to existing Controls  Implement New Controls

12. WINDOWS BASED FORENSIC TOOLKIT

13. TABLEAU WRITE BLOCKER  SATA\IDE

14. DIGITAL CAMERA  Document state of evidence  Inventory items seized

15. CHAIN OF CUSTODY FORM  Log all transfer of evidence

16. EVIDENCE BAGS

17. MISC.

18. ACCESSDATA FTK IMAGER  Physical\Logical Hard Drive Acquisition

19. ACCESSDATA FTK IMAGER  Live Memory Acquisition  Encryption Keys, Passwords, Running Processes

20. IMDISK VIRTUAL DISK DRIVER  Mount evidence files as Read Only Hard Drive

21. REGRIPPER  Registry Analysis  SAM  Security  Software  System  NTUser

22. HELIX  Free Version still available  Best of Both Worlds  Run applications from within Windows  Boot from Linux Live CD

23. MALWAREBYTES ANTI-MALWARE

24. EXIFTOOL - PHOTOS

25. EXIFTOOL – OFFICE DOCUMENTS

26. PROCMON

27. INTERNET EVIDENCE FINDER

28. FORENSIC SOFTWARE SUITE

29. FORENSICS AND THE STATE OF MICHIGAN  PROFESSIONAL INVESTIGATOR LICENSURE ACT  As of May 28, 2008, all computer forensic firms must have a Private Investigators license to practice in Michigan.  Any person engaged in the collection of electronic evidence and/or engaged for the presentation electronic evidence in a Michigan court must have a valid Private Investigators License

30. REFERENCES & THANKS  NIST 800-61  NIST 800-86  http://www.cert.org/csirts/Creating-A-CSIRT.html  http://www.ussecurityawareness.org/highres/incident- response.html  http://windowsir.blogspot.com  http://www.ericjhuber.com  Chris Pogue – Trustwave SpiderLabs  http://blog.spiderlabs.com (Sniper Forensics)

31. NEXT TIME