SY110: Vulnerabilty Management and Incident Response


Incident Response and Digital Forensics

Learning Outcomes

After completing these activities you should be able to:



Incident Response

The risk management strategy is an important factor in establishing policies and procedures for Incident Response (IR) management. Organizations need to consider IR management and planning as part of the mission and business processes, to include operations and systems. Cyberspace scanarios involving incidents include the compromise of software and hardware supply chain; data breaches that results in unauthorized disclosure, loss of control, unauthorized acquisition, or compromise of Personally Identifiable Information (PII); suspicious email communications that can contain malicious code; and many more based on critical business operations and testing outcomes based on risk assessments. IR plans are often executed through the use of playbooks that outline workflows between teams and departments for how the IR lifecycle will be executed.

IR Lifecycle. The illustration describes the major
phases of the incident response process — preparation, detection
and analysis, containment, eradication and recovery, and post-incident
activity. Image courtesy of NIST.

IR Lifecycle

The IR lifecycle has four phases that encourage the flow of information throughout the incident handling process - (1) preparation, (2) detection and analysis, (3) containment, eradication, and recovery, and (4) post-incident activity.

Preparation. The initial phase involves establishing and training an IR team (people), defining roles and responsibilities between leadership and departments through policies and procedures (processes), and acquiring the necessary tools and resources for executing tasks in the following phases (technologies). Risk assessments will help direct and prioritize mission and business operations, with proactive approaches needed in establishing standards for the utilization of security frameworks, system configuration hardening, and improving cybersecurity posture through processes improvement.

Developing processes and playbooks to handle incidents during this phase is crucial for effective communications, access to resources, and management engagement during the IR and handling process.

Detection and Analysis. There may be requirements once an incident has been declared, which includes legal, regulatory, and compliance requirements to consider. For example, certain federal entities are required to report cyber incidents to CISA within 72 hours under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022. This has been the case for the financial banking industry based on a 2021 regulatory agency ruling that mandates the reporting of any significant computer-security incident within 36 hours.

Upon declaration of a cybersecurity incident, collection of data is necessary to preserve any evidence for future analysis and for Computer Emergency Response Teams (CERT) to determine the root cause of an incident. This includes accessing and leveraging network and security tools to investigate and determine any findings related to the incident. Leveraging existing frameworks, such as the MITRE ATT&CK will allow IR personnel to quickly assess Tactics, Techniques, and Procedures (TTPs) for any malicious activities or active attacks taking place.

Containment, Eradication, and Recovery. Containment intends to isolate attacks and malicious activities by identifying the source, access, and any data loss. Containment actions may include removing access to systems and services or disabling accounts that impact business operations.

Eradication is the process for removing any trace of the incident or intrusion from operational systems and networks. Reimaging systems, restoring files from backups, rebuilding networks and accounts are actions taken to ensure the removal of anything that may have been compromised during the incident. Changes to system and security configurations may include additional rules that have been implemented to filter malicious communications, block external connections, or further segment networks. These configuration changes may be added to updated hardening requirements in the next phase of post-incident activity. Increased monitoring and checks will continue through to the recovery phase to ensure there are no remnants of malicious activities.

Recovery is the process of returning the network and systems to a known, operational state. Interruption of enterprise operations may have been authorized during containment and would need to be backed out to restore and reconstitute services.

Post-Incident Activity. Preservation of any of the evidence collected during early response phases should be verified as well as any records used to document the incident and timelines. Configuration management updates and any exceptions to changes made for deploying security hardening changes should be implemented across all enterprise systems. Lessons learned should be conducted across teams to also document and improve processes that identified gaps in the response, re-training required for users and IR personnel, and update to policies, as required. Testing and monitoring for reoccurrence should continue.

Security Operations and Cyber Fusion Centers

Large enterprise organizations have to coordinate and manage staff across geographically separated business and technical operations. Security Operations Centers (SOCs) combine stakeholders across departments, to include management and technical personnel, allowing for centralized communications and control for the coordination of IR plans and security operations. Further expanding coordination across multiple external agencies and organizations can improve on the shortfalls of a traditional SOC and into a Cyber Fusion Center (CFC), which includes threat intelligence, threat hunting, Security Information and Event Management (SIEM), security orchestration, and Information Sharing and Analysis Centers (ISACs). The evolution of the importance of cybersecurity coordination have also come to be known as Joint Operations Centers (JOCs) or Joint Security Operations Centers (JSOCs). Below are links to agencies and organizations that have implemented centers to address the growing cybersecurity threats:

Interpol CFC - https://www.interpol.int/en/Crimes/Cybercrime/Cybercrime-threat-response
New York State JSOC - https://its.ny.gov/joint-security-operations-center-jsoc
Target CFC - https://opensource.target.com/security

Security Operations Centers.

Digital Forensics and the War on Terror

When terrorists or insurgents are captured, or when a hideout is discovered, one of the first orders of business is to search for computers, memory sticks, cell phones, and other kinds of electronic devices. Then operatives carry out forensic analysis on the electronic devices in hopes of finding information about things like attack plans, or identities of other terrorists.

For example, when Osama bin Laden's compound was raided, a wealth of digital data were captured: five computers, dozens of hard drives, and more than 100 other storage devices.

CNN Article, May 2012

Abbottabad Compound

Digital Forensics

Forensics is the scientific analysis of physical evidence, as from a crime scene or other related incident. When we use the term 'digital forensics' we are referring to the analysis of events on an information system. From this evidence, we can reconstruct certain incidents and gather information about the user, the system, and the data affected.

When might we want to reconstruct a sequence of digital events? If a server is hacked and we need to know how it was done or even when, we want to check the status of our system. The sexiest of the digital forensic scenarios is more CSI style: you recover a computer and you want to know what kind of shenanigans were done with it. You might be looking for criminal evidence or traces of certain events. We'll focus on that kind of scenario.

Locard's Exchange Principle

In traditional, CSI-style forensics, one of the guiding concepts is Locard's Exchange Principle, which speculates that every time you make contact with another person, place, or thing, it results in an exchange of physical materials. Thus, in the commission of a crime, the perpetrator leaves something at AND takes something from the crime scene. These "somethings" are evidence. More colorfully:

Wherever he steps, wherever he touches, whatever he leaves, even without consciousness, will serve as a silent witness against him, his fingerprints or his footprints, but his hair, the fibers from his clothes, the glass he breaks, the tool mark he leaves, the paint he scratches, the blood he deposits or collects. All of these and more, bear mute witness against him. This is evidence that does not forget. It is not confused by the excitement of the moment. It is not absent because human witnesses are. It is factual evidence. Physical evidence cannot be wrong, it cannot perjure itself, it cannot be wholly absent. Only human failure to find it, study and understand it, can diminish its value. — Paul L. Kirk. 1953.

Locard's principle holds in the digital world as well and, in fact, it holds whether you are perpetrating a crime or not. We have seen several examples of this already.

A few more examples of "things you leave" on remote hosts

In addition to visiting websites, one of the ways we've seen that we "go somewhere" in the cyber world is by using SSH to get a terminal on a remote host. It's interesting to see what you leave behind when you do this:

  1. Login attempts: Every attempt you make to login to a system, successful or not, is logged! On ssh.cyber.usna.edu, for example, there is a file /var/log/auth.log that the sysadmin (System Administrator) has access to, that contains a log entry for every successful and unsuccessful attempt to login. Here's an example of a few entries: 
    Nov  1 08:38:05 ssh.cyber.usna.edu sshd[3962]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=131.122.6.104  user=mxxxxxx
Nov  1 08:38:05 ssh.cyber.usna.edu sshd[3962]: Accepted password for mxxxxxx from 131.122.6.104 port 49961 ssh2
Nov  1 08:38:05 ssh.cyber.usna.edu sshd[3962]: pam_unix(sshd:session): session opened for user mxxxxxx by (uid=0)
    This tells us that at 8:38am on 1 November, someone at host 131.122.6.104 tried to login as user mxxxxxx, gave the wrong password, then tried to login again and was successful. Think about how this could be used to track someone who was doing or trying to do bad things!
  2. Commands executed: Every command you execute is logged! On ssh.cyber.usna.edu, for example, the sysadmin has a tool called lastcomm that lists every command executed by any user. Here's an example of a few lines output by the command: 
    md5sum                 mxxxxxx  ??         0.00 secs Thu Nov  3 07:36
bash              F    mxxxxxx  ??         0.00 secs Thu Nov  3 07:36
ssh                    mxxxxxx  ??         0.00 secs Thu Nov  3 07:36
bash              F    mxxxxxx  ??         0.00 secs Thu Nov  3 07:36
    What do we learn from this? We learn that at 7:36am on 3 November user mxxxxxx computed an MD5 hash and then ssh'd to some host. Think about how that might be used as evidence.

    In fact, there's a command called history that will bring up the last N commands you've given, along with arguments like filenames, etc. If you login to your ssh.cyber.usna.edu account and give the history command, you'll see all the commands probably that you've ever given on ssh.cyber.usna.edu!

A few more examples of things that stay with you on your machine

Altering the registry on a Windows system can lead to system instability or system crashes. Do not modify registry data unless you know what you are doing. In SY110 we will not have you modify registry values, you will only read registry values.
Follow the below steps to launch an alternate version of regedit:
  • Direct from Search Dialog, Run Dialog, or an Administrator shell:
    1. Enter command: regedt32
    2. If prompted, click Yes in the User Account Control dialog.

The digital forensics lab will explore the kind of information that stays behind — perhaps unexpectedly — on your Windows computer. So we mention only a few examples here (these are the typical locations, although exact locations may vary due to operating system version, implementations, and local IT policies):

  1. Browser cache: C:\Users\m9999\AppData\Local\Google\Chrome\User Data\Default\Cache
      - Browser history: Ctl + H
      - Browser history in the file system: C:\Users\m9999\AppData\Local\Google\Chrome\User Data\Default\History
  2. Recently accessed files: If you launch regedit and look under:
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
    you will see a list that shows files that you opened recently, sorted by file extension. If you right-click and choose "Modify", you'll see the file names.
  3. Networks you've been on:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures
    and then look under both Managed and Unmanaged you'll see among other things the MAC Addresses of the Gateway Routers for networks you've been on.
      - View previously connected wireless networks: netsh wlan show profiles
  4. "Meta-data" in documents: Programs like Microsoft Word store "meta data" in the documents they create. For example, if you right-click on the icon for a Word file, choose "Properties," and look under the "Details" tab, you often find information like the name of the document's author, an e-mail address, the username of the author, and so forth. These documents that get published to the world may leak information that could be used for evil purposes.

File Carving

File carving is an incredibly useful skill to have in the world of digital forensics. It is the process used in computer forensics to extract data from a storage device after the files have been deleted, the device has been erased, or the device has been damaged. But, at this point, the data on the device just looks like a sequence of "raw bytes" — meaning a sequence of bytes without any information as to where any file begins or ends in the sequence of bytes. In order to extract valuable data from these raw bytes, file carving is necessary.