cybersecurity

1. © 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
System Forensics,
Investigation, and Response
Lesson 13
Incident and Intrusion Response

2. Page 2
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Learning Objective
 Describe incident and intrusion response.
 Understand how to forensically respond to
intrusions.

3. Page 3
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Key Concepts
 Disaster recovery
 Evidence preservation
 How to integrate forensics to incident response

4. Page 4
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
What Is Disaster Recovery?
 Steps taken after an information technology-
related disaster to restore operations
 Forensic techniques may be best method for
determining what caused the disaster and for
avoiding a repeat of it
 Forensic process begins once an incident has
been discovered
• Is not fully underway until after the disaster or
incident is contained

5. Page 5
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Incident Response Plan
In place to respond to:
• Fire
• Flood
• Hurricane
• Tornado
• Hard drive failure
• Network outage
• Malware infection
• Data theft or deletion
• Intrusion

6. Page 6
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Business Continuity, Incident
Response, and Disaster Recovery
Incident
response
Disaster
recovery
Business
continuity Digital
forensics

7. Page 7
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Types of Plans
Business continuity plan (BCP)
• Focuses on keeping an organization
functioning as well as possible until a full
recovery can be made
Disaster recovery plan (DRP)
• Focuses on executing a full recovery to normal
operations
• Sometimes referred to as an incident response
plan (IRP)

8. Page 8
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Types of Plans (Cont.)
In other words:
• BCP concerned with maintaining at least
minimal operations until organization can be
returned to full functionality
• DRP focuses on returning to full
functionality

9. Page 9
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Federal Standards for BCPs
ISO 27001
NIST 800-34
NFPA 1600

10. Page 10
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Federal Standards for BCPs
(Cont.)
ISO 27035
NIST 800-61

11. Page 11
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Business Impact Analysis (BIA)
A study that identifies the effects a disaster
would have on business and IT functions
• Studies include interviews, surveys,
meetings, and so on
Identifies the priority of different critical
systems
Considers maximum tolerable downtime
(MTD)

12. Page 12
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Maximum Tolerable Downtime
(MTD)
 A measure of how long a system or systems can
be down before it is impossible for the
organization to recover
 Related to:
• Mean time to repair (MTTR) – The average time it
takes to repair an item
• Mean time to failure (MTTF) – The amount of time,
on average, before a given device is likely to fail
through normal use

13. Page 13
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
The Recovery Plan
Recovery
plan
BCP
DRP
BIA

14. Page 14
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
The Recovery Plan (cont.)
1. Alternate equipment identified?
2. Alternate facilities identified?
3. Mechanism in place for contacting all
affected parties, employees, vendors,
customers, and contractors, even if primary
means of communication are down?
4. Off-site backup of the data exists?
5. Can backup be readily retrieved and
restored?

15. Page 15
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Types of Backups
Full – All changes
Differential – All changes since the last full
backup
Incremental – All changes since the last
backup of any type
Hierarchical storage management (HSM) –
Continuous backup

16. Page 16
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
The Post-Recovery Follow-Up
After recovery, find out what happened and
why (involves forensics):
• Was disaster caused by some weakness in
the system?
• Negligence by an individual?
• A gap in policy?
• An intentional act?

17. Page 17
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Incident Response
Containment Eradication Recovery Follow-up

18. Page 18
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Containment
Limit the incident
Prevent it from affecting more systems

19. Page 19
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Eradication
Fix vulnerabilities
• Example: Remove the malware
Perform comprehensive examination of
what occurred and how far it reached
Ensure that the issue was completely
addressed
Forensics begins at this stage

20. Page 20
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Recovery
Involves returning the affected systems to
normal status
If malware:
• Ensure the system is back in full working
order with no presence of malware
• Might need to restore software and data
from backup

21. Page 21
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Follow-up
Forensics plays a critical role
IT team must determine:
• How incident occurred
• What steps can be taken to prevent incident
from reoccurring

22. Page 22
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Preserving Evidence
 An event:
• Is any observable occurrence within a system
or network
• Includes network activity, such as when a user
accesses files on a server or when a firewall
blocks network traffic
 Adverse events have negative results or negative
consequences
• Example: An attack on a system

23. Page 23
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Computer Security Incidents
Denial of service (DoS) attacks
Malicious code
Unauthorized access
Inappropriate usage

24. Page 24
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Preserving Evidence (Cont.)
Recovery often performed at the expense
of preserving forensic evidence
Failure to preserve forensic information:
• Prevents IT team from effectively evaluating
cause of incident
• Makes it difficult to modify company policies
and procedures to reduce risk
Forensic data is key to preventing future
incidents

25. Page 25
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Adding Forensics to Incident
Response
 Identify forensic resources the organization
can use in case of an incident
 Identify an outside party that can respond to
incidents with forensically trained personnel
 Weave forensic methodology into
organization's incident response policy
 Provide appropriate training to staff for
preserving evidence

26. Page 26
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Summary
Disaster recovery
Evidence preservation
How to integrate forensics to incident
response