Upload File

forensics in cybercrime cases - varni na internetu · • nist's computer security incident...

  • Home
  • Documents
  • Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response
25
Forensics in cybercrime cases What happens to organizations that have to deal with a cyber-attack?

Upload: others

Post on 22-Jun-2020

5 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Forensics in cybercrime casesWhat happens to organizations that

have to deal with a cyber-attack?

Page 2: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

About me

• Christian Prickaerts• [email protected]

• My day job• In charge of DFIR @Fox-IT

• Providing expert witness testimony

• SANS Institute instructor

Page 3: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response
Page 4: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Digital forensics 15 years ago

Page 5: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Digital forensics anno 2014

Page 6: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Role of digital forensics in IR?

Page 7: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response
Page 8: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Black Swan

• High-impact

• Hard-to-predict

• Non-computable

• Psychological biases blinds

Page 9: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response
Page 10: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response
Page 11: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Incident Response

• NIST's Computer Security Incident Handling Guide (SP800-61)

Guide to Integrating Forensic Techniques into Incident Response (SP800-86)

Page 12: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Incident Response lifecycle

Page 13: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response
Page 14: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Digital forensics – the challenge

• Digital information is everywhere• Computer

• Mobile devices

• Network

• External storage devices

• Backup tapes

• The cloud

• Increasingly more data in many different formats

• Added challenges: duplicates, malformed data

Page 15: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Security Intelligence

Analysis of successful intrusion

Analysis and synthesis of unsuccessful intrusionMichael Cloppert, 2009

Page 16: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Use the force

• Imaging all and always is not time efficient

• Provide intelligence quickly• Perform live forensic analysis

• Using forensically sound tools

• Combine• Network data

• File system data

• Operating system data

• Application data

Page 17: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Manage your logs

Page 18: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Data in your network

• Log files of network systems:• Firewall logs

• IDS logs

• VPN logs

• Proxy logs

• Active directory logs

• DHCP logs

• Synchronize systems with central NTP system

Page 19: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

A cunning plan.....

19

“Delete the logs and use a program likeCCleaner to destroy possible relevant evidence

to frustrate the forensic investigation”

Page 20: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Modus Operandi

Page 21: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Digital forensics in court

Page 22: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

European Commission

• Upcoming (new) data-protection legislation

• Data breach notification: The drafted rules are similar to rules in relation to providers of public (electronic) communications services

• To be able to notify, one must know

Page 23: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

First fully documented digital forensic investigation

• The Cuckoo's Egg

• Written by Clifford Stoll

• The story:• Hacker active in defense networks

• Unix sysadmin investigates the incident

• Pioneer in digital forensics

Page 24: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Educate your staff

“If you think education is expensive, try ignorance.”

Derek Bok, former president of Harvard

“It does not matter how slowly you go as long as you do not stop.”

Confucius

Page 25: Forensics in cybercrime cases - Varni na internetu · • NIST's Computer Security Incident Handling Guide (SP800-61) Guide to Integrating Forensic Techniques into Incident Response

Christian [email protected]


NIST's Semantic Approach to Standards and Interoperability

Module 14 Major Incident Management Module 14 Major Incident Management incident Problems in major and complex incident management Major incident management

Andraž Sraka: Varni protokoli na internetu [Cryptoparty Slovenija 2015]

FONDAZIONE “VARNI AGNETTI” O.N.L.U.S. · [email protected] PEC [email protected] Rev. 34 Data di emissione 18/09/2017 2 Presentazione La Fondazione “Varni Agnetti”,

Fondazione Varni Agnetti Onlus: Casa di riposo a Godiasco ... · Sono 136 i lavoratori che ruotano attorno alla 'Varni Agnetti' di Godiasco questi dati. Se negli anni 80- 90, come

Evaluating Incident Commander Performance - Incident

Shabal, a Submission to NIST's Cryptographic Hash

Factors that influence Psychosocial Functioning in ...libres.uncg.edu/ir/uncg/f/J_Telfair_Factors_2000.pdfpsychosocial resistance factors (Wallander & Varni, 1992; Wallander, Varni,

Hospital Incident Command System Module 11 Incident Planning and Incident Response Scenarios

Economic Analysis of NIST's Low-k Materials

Varni pred požarom

Cementation #1 Shaft Incident July 6th 2011. 2 Incident overview Incident Timeline Incident Causation Recommendations Cementation #1 Shaft Incident

€¦ · Cat - 1st Incident Dog - 1st Incident Dog - 2nd Incident Dog - 3rd Incident Redemption No Current License Cat - 1st Incident Dog - 1st Incident Dog - 2nd Incident Dog - 3rd

Incident Command System Incident Command System

Incident Response Incident Response Process Forensics

Varni pred požarom v tretjem življenjskem obdobju

Varni na internetu: Ne bodi kot Andreja!mrezaznanja.si/files/2016/09/14_Marta-Štefanič_Ne-bodi-kot-Andreja.… · Marta Štefanič. Arnes. [email protected]. Varni na internetu:

O pravilni in varni uporabi zdravil Imunski sistem...2925 13. Dan slovenskih lekarn 26. september 2017 O pravilni in varni uporabi zdravil Imunski sistem LEKARNIŠKA ZBORNICA SLOVENIJE

NIST's Role in Forensic Science

National Incident Management System (NIMS) Incident

Varni na internetu: Ne bodi kot Andreja! · Marta Štefanič. Arnes. [email protected]. Varni na internetu: Ne bodi kot Andreja! Mreža znanja 2016 24. november 2016, Ljubljana

LIVRE BLANC - Varonis...LIVRE BLANC VARNI LA CNRIÉ A DR AVEC VARNI 3 Présentation Le 25 mai 2018, le Règlement général sur la protection des données (GDPR) de l'UE entrera en

NATIONAL INTERAGENCY FIRE CENTER. NATIONAL INTERAGENCY INCIDENT COMMUNICATIONS DIVISION INCIDENT SUPPORT INCIDENT SUPPORT NATIONAL INCIDENT RADIO SUPPORT

Uncertainty Analysis of NIST's 20 Liter Hydrocarbon Liquid

Department of Commerce Technology Administration Institute … · 2014-06-23 · advancedtechnologies. NIST's research facilitiesare located at Gaithersburg, MD 20899,and at Boulder,

NIST's ultrasonic technology assessment program to improve ... · Technical advances in ultrasonics can significantly improve flow measurement in the continuous process industries

Responses to NIST's proposal - Massachusetts Institute of ... · Who Holds t:he Keys? I NIST's Proposal he U.S. Government agency NIST has recently proposed a public key digital signature

NATIONAL INCIDENT MANAGEMENT SYSTEM INCIDENT COMMAND

Small-N and Single-subject Designs Susan Varni Fall 2002

NIST's Nanotechnology Strategy

Data Breach IncIDent response plan toolkIt · Incident Response Team 3 Incident Response Contact Sheet 4 Suspecting or Detecting an Incident 5 Incident Response Discovery Form 6 Incident

Planning Report 01-2 The Economic Impactsof NIST's Data

Incident Sheet ORI : TX0710200 Incident Number

O pravilni in varni uporabi zdravil Imunski sistem - sfd.si · 2925 13. Dan slovenskih lekarn 26. september 2017 O pravilni in varni uporabi zdravil Imunski sistem LEKARNIŠKA ZBORNICA

Varni ų regioninis parkas . Žaliosios mokymosi aplinkos 1 dalis