Incident Response

1. Incident Response Incident Response Process Forensics

2. Objectives Students should be able to: Define and describe an incident response plan and business continuity plan Define recovery terms: interruption window, service delivery objective, maximum tolerable outage, alternate mode, acceptable interruption window Describe incident management team, incident response team, proactive detection, triage Define and describe computer forensics: authenticity, continuity, forensic copy, chain of custody, imaging, extraction, ingestion or normalization, case log, investigation report Develop a high-level incident response plan

3. How to React to…? Denial of Service Accidents Viruses Stolen Laptop Social Engineering Theft of Proprietary Information System Failure Lost Backup Tape Hacker Intrusion Fire!

4. Incident Response vs. Business Continuity Incident Response Planning (IRP) • Security-related threats to systems, networks & data • Data confidentiality • Non-repudiable transactions Business Continuity Planning • Disaster Recovery Plan • Continuity of Business Operations • IRP is part of BCP and can be *the first step*

5. Review: Business Continuity Recovery Terms Interruption Window: Time duration organization can wait between point of failure and service resumption Service Delivery Objective (SDO): Level of service in Alternate Mode Maximum Tolerable Outage: Max time in Alternate Mode Disaster Recovery Plan Implemented Regular Service Regular Service Alternate Mode SDO Time… Restoration Plan Implemented (Acceptable) Interruption Window Interruption Maximum Tolerable Outage

6. Vocabulary • IMT: Incident Management Team • IS Mgr leads, includes steering committee, IRT members • Develop strategies & design plan for Incident Response, • integrating business, IT, BCP, and risk management • Obtain funding, Review postmortems • Meet performance & reporting requirements IRT: Incident Response Team Handles the specific incident. Has specific knowledge relating to: Security, network protocols, operating systems, physical security issues, malicious code, etc. Permanent (Full Time) Members: IT security specialists, incident handlers, investigator Virtual (Part Time) Members: Business (middle mgmt), legal, public relations, human resources, physical security, risk, IT

7. Incident Response Plan (IRP) Preparation Plan PRIOR to Incident Identification Determine what is/has happened Containment & Escalation Limit incident [If data breach] Notify any data breach victims Analysis & Eradication Notification Determine and remove root cause Ex-Post Response Return operations to normal Establish call center, reparation activities Recovery Process improvement: Plan for the future Lessons Learned

8. Why is incident response important? $201: average cost per breached record 66% of incidents took > 1 month to years to discover 82% of incidents detected by outsiders 78% of initial intrusions rated as low difficulty

9. Stage 1: Preparation What shall we do if different types of incidents occur? (BIA helps) When is the incident management team called? How can governmental agencies or law enforcement help? When do we involve law enforcement? What equipment do we need to handle an incident? What shall we do to prevent or discourage incidents from occurring? (e.g. banners, policies) Where on-site & off-site shall we keep the IRP?

10. (1) Detection Technologies Organization must have sufficient detection & monitoring capabilities to detect incidents in a timely manner Proactive Detection includes: • Network Intrusion Detection/Prevention System (NIDS/NIPS) • Host Intrusion Detection/Prevention System (HIDS/HIPS) • Antivirus, Endpoint Security Suite • Security Information and Event Management (Logs) • Vulnerability/audit testing • System Baselines, Sniffer • Centralized Incident Management System • Input: Server, system logs • Coordinates & co-relates logs from many systems • Tracks status of incidents to closure Reactive Detection: Reports of unusual or suspicious activity

11. Logs to Collect & Monitor

12. Incidents may include… IT Detects Employees Reports Malware Violations of policy Data breach: stolen laptop, memory employee mistake Social engineering/fraud: caller, e-mail, visitors Unusual event: inappropriate login unusual system aborts server slow deleted files defaced website • a device (firewall, router or server) issues serious alarm(s) • an IDS/IPS recognizes an irregular pattern: • unusually high traffic, • inappropriate file transfer • changes in protocol use • unexplained system crashes or • unexplained connection terminations

13. (1) Management Participation • Management makes final decision • As always, senior management has to be convinced that this is worth the money. • Actual Costs: Ponemon Data Breach Study, 2014, Sponsored by Symantec

14. WorkbookIncident Types

15. Stage 2: Identification Triage: Categorize, prioritize and assign events and incidents • What type of incident just occurred? • What is the severity of the incident? • Severity may increase if recovery is delayed • Who should be called? • Establish chain of custody for evidence

16. (2) Triage Snapshot of the known status of all reported incident activity • Sort, Categorize, Correlate, Prioritize & Assign Categorize: DoS, Malicious code, Unauthorized access, Inappropriate usage, Multiple components Prioritize: Limited resources requires prioritizing response to minimize impact Assign: Who is free/on duty, competent in this area?

17. (2) Chain of Custody • Evidence must follow Chain of Custody law to be admissible/acceptable in court • Include: specially trained staff, 3rd party specialist, law enforcement, security response team System administrator can: • Retrieve info to confirm an incident • Identify scope and size of affected environment (system/network) • Determine degree of loss/alteration/damage • Identify possible path of attack

18. Stage 3: Containment • Activate Incident Response Team to contain threat • IT/security, public relations, mgmt, business • Isolate the problem • Disable server or network zone comm. • Disable user access • Change firewall configurations to halt connection • Obtain & preserve evidence

19. (3) Containment - Response Technical • Collect data • Analyze log files • Obtain further technical assistance • Deploy patches & workarounds Managerial • Business impacts result in mgmt intervention, notification, escalation, approval Legal • Issues related to: investigation, prosecution, liability, privacy, laws & regulation, nondisclosure

20. Stage 4: Analysis & Eradication • Determine how the attack occurred: who, when, how, and why? • What is impact & threat? What damage occurred? • Remove root cause: initial vulnerability(s) • Rebuild System • Talk to ISP to get more information • Perform vulnerability analysis • Improve defenses with enhanced protection techniques • Discuss recovery with management, who must make decisions on handling affecting other areas of business

21. (4) Analysis What happened? Who was involved? What was the reason for the attack? Where did attack originate from? When did the initial attack occur? How did it happen? What vulnerability enabled the attack?

22. (4) Remove root cause If Admin or Root compromised, rebuild system Implement recent patches & recent antivirus Fortify defenses with enhanced security controls Change all passwords Retest with vulnerability analysis tools

23. Stage 5: Recovery Restore operations to normal Ensure that restore is fully tested and operational

24. WorkbookIncident Handling Response

25. Stage 6: Lessons Learned • Follow-up includes: • Writing an Incident Report • What went right or wrong in the incident response? • How can process improvement occur? • How much did the incident cost (in loss & handling & time) • Present report to relevant stakeholders

26. Planning Processes Risk & Business Impact Assessment Response & Recovery Strategy Definition Document IRP and DRP Train for response & recovery Update IRP & DRP Test response & recovery Audit IRP & DRP

27. Training Introductory Training: First day as IMT Mentoring: Buddy system with longer-term member Formal Training On-the-job-training Training due to changes in IRP/DRP

28. Types of Penetration Tests External Testing: Tests from outside network perimeter Internal Testing: Tests from within network Blind Testing: Penetration tester knows nothing in advance and must do web research on company Double Blind Testing: System and security administrators also are not aware of test Targeted Testing: Have internal information about a target. May have access to an account. Written permission must always be obtained first CISA Review Manual 2009

29. Incident Management Metrics # of Reported Incidents # of Detected Incidents Average time to respond to incident Average time to resolve an incident Total number of incidents successfully resolved Proactive & Preventative measures taken Total damage from reported or detected incidents Total damage if incidents had not been contained in a timely manner

30. Challenges • Management buy-in: Management does not allocate time/staff to develop IRP • Top reason for failure • Organization goals/structure mismatch: e.g., National scope for international organization • IMT Member Turnover • Communication problems: Too much or too little • Plan is to complex and wide

31. Question The MAIN challenge in putting together an IRP is likely to be: Getting management and department support Understanding the requirements for chain of custody Keeping the IRP up-to-date Ensuring the IRP is correct

32. Question The PRIMARY reason for Triage is: To coordinate limited resources To disinfect a compromised system To determine the reasons for the incident To detect an incident

33. Question When a system has been compromised at the administrator level, the MOST IMPORTANT action is: Ensure patches and anti-virus are up-to-date Change admin password Request law enforcement assistance to investigate incident Rebuild system

34. Question The BEST method of detecting an incident is: Investigating reports of discrepancies NIDS/HIDS technology Regular vulnerability scans Job rotation

35. Question The person or group who develops strategies for incident response includes: CISO CRO IRT IMT

36. Question The FIRST thing that should be done when you discover an intruder has hacked into your computer system is to: • Disconnect the computer facilities from the computer network to hopefully disconnect the attacker • Power down the server to prevent further loss of confidentiality and data integrity • Call the police • Follow the directions of the Incident Response Plan

37. Computer Investigationand Forensics Computer Crime Investigation Chain of Command Computer Forensics

38. Computer Crime Investigation Analyze copied images Call Police Or Incident Response Evidence must be unaltered Chain of custody professionally maintained Four considerations: Identify evidence Preserve evidence Analyze copy of evidence Present evidence Take photos of surrounding area Copy memory, processes files, connections In progress Preserve original system In locked storage w. min. access Power down Copy disk

39. Computer Forensics • Did a crime occur? • If so, what occurred? Evidence must pass tests for: • Authenticity: Evidence is a true and faithful original of the crime scene • Computer Forensics does not destroy or alter the evidence • Continuity: “Chain of custody” assures that the evidence is intact.

40. Chain of Custody 11:47-1:05 Disk Copied RFT & PKB 11:05-11:44 System copied PKB & RFT 11:04 Inc. Resp. team arrives Time Line 10:53 AM Attack observed Jan K 11:15 System brought Offline RFT 11:45 System Powered down PKB & RFT 1:15 System locked in static-free bag in storage room RFT & PKB Who did what to evidence when? (Witness is required)

41. Preparing Evidence Work with police to AVOID: • Contaminating the evidence • Voiding the chain of custody • Evidence is not impure or tainted • Written documentation lists chain of custody: locations, persons in contact – time & place • Infringing on the rights of the suspect • Warrant required unless… • Company permission given; in plain site; communicated to third party; evidence in danger of being destroyed; or normal part of arrest; ...

42. Computer Forensics The process of identifying preserving, analyzing and presenting digital evidence for a legal proceeding

43. Creating a Forensic Copy 2) Accuracy Feature: Tool is accepted as accurate by the scientific community: Original Mirror Image 4) One-way Copy: Cannot modify original 5) Bit-by-Bit Copy: Mirror image 3) Forensically Sterile: Wipes existing data; Records sterility 1) & 6) Calculate Message Digest: Before and after copy 7) Calculate Message Digest Validate correctness of copy

44. Computer Forensics Data Protection: Notify people that evidence cannot be modified Data Acquisition: Transfer data to controlled location • Copy volatile data • Interview witnesses • Write-protect devices Imaging: Bit-for-bit copy of data Extraction: Select data from image (logs, processes, deleted files) Interrogation: Obtain info of parties from data (phone/IP address) Ingestion/Normalization: Convert data to an understood format (ASCII, graphs, …) Reporting: Complete report to withstand legal process

45. Legal Report Describe incident details accurately Be understandable and unambiguous Offer valid conclusions, opinions, or recommendations Fully describe how conclusion is reached Withstand legal scrutiny Be created in timely manner Be easily referenced

46. Forensics: Chain of Custody Forms • Chain of Custody Form: Tracks where & how evidence was handled. Includes: • Name & Contact info of custodians • Detailed identification of evidence (e.g, model, serial #) • When, why, and by whom evidence was acquired or moved • Where stored • When/if returned • Detailed Activity Logs • Checklists for acquiring technicians • Signed non-disclosure forms

47. Forensics: Case Log Case log includes: Case number Case basic notes, requirements, procedures Dates when requests were received Dates investigations were assigned to investigators Date completed Name and contact information for investigator and requestor

48. Forensics:Investigation Report Name and contact info for investigators Case number Dates of investigation Details of interviews or communications Details of devices or data acquired (model, serial #) Details of software/hardware tools used (must be reputable in law) Details of findings, including actual data Signature of investigator

49. Question Authenticity requires: Chain of custody forms are completed The original equipment is not touched during the investigation Law enforcement assists in investigating evidence The data is a true and faithful copy of the crime scene

50. Question You are developing an Incident Response Plan. An executive order is that the network shall remain up, and intruders are to be pursued. Your first step is to… Use commands off the local disk to record what is in memory Use commands off of a memory stick to record what is in memory Find a witness and log times of events Call your manager and a lawyer in that order