SlideShare a Scribd company logo

INTRODUCTION TO CYBER FORENSICS

•
•
S
Sylvain Martinez

This document provides an introduction to cyber forensics. It defines key terms like forensics science, digital forensics, and cyber forensics. It also discusses cyber attack and malware trends, GDPR requirements, core principles of cyber forensics investigations, and presents an overview of the goals, actions, and scope of activities in a cyber forensics investigation. Finally, it provides a case study example of a client database leak investigation.

Technology
1 of 18
Download to read offline
{elysiumsecurity} INTRODUCTION TO CYBER FORENSICS Version: 1.3a Date: 04/07/2018 Author: Sylvain Martinez Reference: ESC6-MUSCL Classification: Public cyber protection & response
{elysiumsecurity} cyber protection & response 2 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT • Core Principles; • Client Database Leak Investigation. CONTENTS Public • Definitions • Cyber Attacks and M alware trends; • GDPR Requirem ents; • Overview; • Goals; • Actions; • Activity Scope;
{elysiumsecurity} cyber protection & response 3 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT DEFINITIONS Public FOREENSIC SCIENCE THE APPLICATION OF SCIENCE TO CRIMINAL AND CIVIL LAWS, DURING CRIMINAL INVESTIGATION, AS GOVERNED BY THE LEGAL STANDARDS OF ADMISSIBLE EVIDENCE AND CRIMINAL PROCEDURE. Definitions from Wikipedia DIGITAL FORENSICS A BRANCH OF FORENSIC SCIENCE ENCOMPASSING THE RECOVERY AND INVESTIGATION OF MATERIAL FOUND IN DIGITAL DEVICES, OFTEN IN RELATION TO COMPUTER CRIME CYBER/COMPUTER FORENSICS A BRANCH OF DIGITAL FORENSIC SCIENCE, THE APPLICATION OF INVESTIGATION AND ANALYSIS TECHNIQUES TO GATHER AND PRESERVE EVIDENCE FROM A PARTICULAR COMPUTING DEVICE IN A WAY THAT IS SUITABLE FOR PRESENTATION IN A COURT OF LAW
{elysiumsecurity} cyber protection & response 4 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT CYBER ATTACKS AND MALWARE TRENDS Public Source: AV-TEST
{elysiumsecurity} cyber protection & response 5 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT GDPR REQUIREMENTS Public ARTICLE 33 72H REPORTING NATURE OF THE BREACH? (WHO? WHERE? HOW?) POTENTIAL IMPACT? WHAT HAS BEEN DONE TO PREVENT THE BREACH? (CONTROLS? PROCESSES?) Icons from the Noun Project unless specified otherwise
{elysiumsecurity} cyber protection & response 6 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT CORE PRINCIPLES Public PRESERVATION OF INTEGRITY CHAIN OF CUSTODY ONLINE/OFFLINE ? NEVER FORGET THE « S »!! ACTIVITY GOALS
{elysiumsecurity} cyber protection & response 7 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT OVERVIEW Public CONTEXT LOGS FILESYSTEM CONFIG NETWORK MEMORY ADVANCED ACTIVITY SCOPE ACQUISITION ANALYSIS REPORTINGACTIONS GOALS IDENTIFICATION Impact/Target/Technique ATTRIBUTION Source of Attack COLLECTION Evidence of compromise Copyright ELYSIUMSECURITY LTD, please refer to us if reusing this diagram: https://www.elysiumsecurity.com
{elysiumsecurity} cyber protection & response 8 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT GOALS Public IDENTIFICATION Impact/Target/Technique ATTRIBUTION Source of Attack COLLECTION Evidence of compromise WHAT? WAS COMPROMISED? WAS STOLEN/MODIFIED? WHERE? THE CONTROLS FAILED? THE DATA WENT? HOW? THEY HACKED? WAS IT STOPPED? WHY? THEY TARGETED YOU? WAS IT SUCCESSFUL? WHO? WAS TARGETED? WAS RESPONSIBLE?
{elysiumsecurity} cyber protection & response 9 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIONS Public ACQUISITION REPORTING ANALYSIS IDENTIFICATION OF EVIDENCE PRESERVATION OF EVIDENCE COLLECTION OF EVIDENCE ANALYSIS OF EVIDENCE DOCUMENTATION OF EVIDENCE PRESENTATION OF EVIDENCE
{elysiumsecurity} cyber protection & response 10 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - CONTEXT Public CONTEXT TIMELINE LOCATION MEDIUM INDIVIDUALS ACTIVITIES READ-ONLY COPY OF EVIDENCE ! INTERVIEWS
{elysiumsecurity} cyber protection & response 11 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - LOG Public LOGS ENDPOINTS SERVERS NETWORK DEVICES CLOUD SERVICES EVENT VIEWER, WEBTOOLS START WITH TIMELINE RANGE READ-ONLY COPY OF EVIDENCE !
{elysiumsecurity} cyber protection & response 12 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - FILESYSTEM Public FILESYSTEM SUPER TIMELINE FILE/APP/KEYWORD SEARCH PLACES OF INTEREST VIRUS SCANS LOG2TIMELINE, TSK HUGE AMOUNT OF DATA READ-ONLY COPY OF EVIDENCE !
{elysiumsecurity} cyber protection & response 13 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - CONFIG Public CONFIG REGISTRY KEY HIVE SYSTEM FILES APPLICATION CONFIGURATION RECENT CHANGES/INSTALLATIONS REGEDIT/HIJACKTHIS/GREP READ-ONLY COPY OF EVIDENCE !
{elysiumsecurity} cyber protection & response 14 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - NETWORK Public NETWORK SOURCE / DESTINATION ACTIVITIES PROTOCOL USED TRAFFIC CONTENT ANALYSIS IDS ANALYSIS WIRESHARK / TCPDUMP READ-ONLY COPY OF EVIDENCE !
{elysiumsecurity} cyber protection & response 15 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - MEMORY Public MEMORY DUMP MEMORY / PAGE FILES RUNNING PROCESSES BINARY INSPECTION HIDDEN DATA VOLATILITY / REKAL READ-ONLY COPY OF EVIDENCE !
{elysiumsecurity} cyber protection & response 16 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - ADVANCED Public ADVANCED USER ACTIVITY SIMULATION MALWARE REVERSE ENGINEERING MALWARE SANDBOXING HONEYPOTS HACKER COMMUNICATION DANGEROUS!READ-ONLY COPY OF EVIDENCE !
{elysiumsecurity} cyber protection & response 17 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT CLIENT DATABASE LEAK INVESTIGATION Public CONTEXT LOG FILESYSTEM CONFIG NETWORK MEMORY ADVANCED - EXECUTIVE ATTENDED A CONFERENCE; - LOGGED TO WEBMAIL; - WARNING IGNORED; - CLIENT DB LEAKED; - 29/05/18 @ 09:09 - TROJAN FILES FOUND; - HIDDEN PARTITION IDENTIFIED; - BAD WEB PLUGIN DELETED; - USB CONNECTION. - PROCESS SENDING DATA TO IP EVERY 5 MINUTES; - ENDPOINT ACTING AS A PROXY FOR INTRANET; - IDS FLAG ALERTS. - MALWARE SOURCE CODE IN FRENCH; - IP TRAIL FROM KNOWN GROUPS; - HACKER FOR HIRE FROM EX EMPLOYEE. - EMAIL LOGING FROM SUSPICIOUS COUNTRY; - EMAIL DELETED TO DB SUPPORT; - VPN ACCESS FROM CONFERENCE. - WEB HISTORY TO FAKE WEBMAIL; - FIREWALL TURNED OFF; - AV WHITELIST OF SUSPICIOUS DIRECTORY; - SUSPICIOUS SERVICE. - HIDDEN PROCESSES; - TROJAN DETECTED IN MEMORY; - REMOTE CONNECTION LIVE;
{elysiumsecurity} cyber protection & response © 2018 Elysium Security Ltd. All Rights Reserved www.elysium security.com ElysiumSecurity provides practical expertise to identify vulnerabilities, assess their risks and impact, remediate those risks, prepare and respond to incidents as well as raise security awareness through an organization. ElysiumSecurity provides high level expertise gathered through years of best practices experience in large international companies allowing us to provide advice best suited to your business operational model and priorities. ABOUT ELYSIUMSECURITY LTD. ElysiumSecurity provides a portfolio of Strategic and Tactical Services to help companies protect and respond against Cyber Security Threats. We differentiate ourselves by offering discreet, tailored and specialized engagements. Operating in Mauritius and in the United Kingdom, our boutique style approach means we can easily adapt to your business operational model and requirements to provide a personalized service that fits your working environment.

Recommended

Digital forensics
Digital forensicsDigital forensics
Digital forensicsyash sawarkar
 
Cybercrime And Cyber forensics
Cybercrime And Cyber forensics Cybercrime And Cyber forensics
Cybercrime And Cyber forensics sunanditaAnand
 
Digital forensics
Digital forensicsDigital forensics
Digital forensicsRoberto Ellis
 
Network Forensics
Network ForensicsNetwork Forensics
Network Forensicsprimeteacher32
 
Analysis of digital evidence
Analysis of digital evidenceAnalysis of digital evidence
Analysis of digital evidencerakesh mishra
 
cyber security and forensic tools
cyber security and forensic toolscyber security and forensic tools
cyber security and forensic toolsSonu Sunaliya
 
Cyber forensics ppt
Cyber forensics pptCyber forensics ppt
Cyber forensics pptRoshiniVijayakumar1
 
Incident response process
Incident response processIncident response process
Incident response processBhupeshkumar Nanhe
 

Recommended

Digital forensics
Digital forensicsDigital forensics
Digital forensicsyash sawarkar
 
Cybercrime And Cyber forensics
Cybercrime And Cyber forensics Cybercrime And Cyber forensics
Cybercrime And Cyber forensics sunanditaAnand
 
Digital forensics
Digital forensicsDigital forensics
Digital forensicsRoberto Ellis
 
Network Forensics
Network ForensicsNetwork Forensics
Network Forensicsprimeteacher32
 
Analysis of digital evidence
Analysis of digital evidenceAnalysis of digital evidence
Analysis of digital evidencerakesh mishra
 
cyber security and forensic tools
cyber security and forensic toolscyber security and forensic tools
cyber security and forensic toolsSonu Sunaliya
 
Cyber forensics ppt
Cyber forensics pptCyber forensics ppt
Cyber forensics pptRoshiniVijayakumar1
 
Incident response process
Incident response processIncident response process
Incident response processBhupeshkumar Nanhe
 
Digital forensics
Digital forensics Digital forensics
Digital forensics vishnuv43
 
Digital Forensics
Digital ForensicsDigital Forensics
Digital ForensicsMithileysh Sathiyanarayanan
 
Cyber Forensics Overview
Cyber Forensics OverviewCyber Forensics Overview
Cyber Forensics OverviewYansi Keim
 
Mobile Forensics
Mobile Forensics Mobile Forensics
Mobile Forensics abdullah roomi
 
Digital Forensic
Digital ForensicDigital Forensic
Digital ForensicCleverence Kombe
 
Introduction to computer forensic
Introduction to computer forensicIntroduction to computer forensic
Introduction to computer forensicOnline
 
Cyber crime and forensic
Cyber crime and forensicCyber crime and forensic
Cyber crime and forensicSANTANU KUMAR DAS
 
Network forensic
Network forensicNetwork forensic
Network forensicManjushree Mashal
 
Current Forensic Tools
Current Forensic Tools Current Forensic Tools
Current Forensic Tools Jyothishmathi Institute of Technology and Science Karimnagar
 
Legal aspects of digital forensics
Legal aspects of digital forensics Legal aspects of digital forensics
Legal aspects of digital forensics KakshaPatel3
 
Preserving and recovering digital evidence
Preserving and recovering digital evidencePreserving and recovering digital evidence
Preserving and recovering digital evidenceOnline
 
MSAB XRY ver.9.4 and XAMN ver. 6.pdf
MSAB XRY ver.9.4 and XAMN ver. 6.pdfMSAB XRY ver.9.4 and XAMN ver. 6.pdf
MSAB XRY ver.9.4 and XAMN ver. 6.pdfRASLAKK
 
Intro to cyber forensics
Intro to cyber forensicsIntro to cyber forensics
Intro to cyber forensicsChaitanya Dhareshwar
 
Anti forensic
Anti forensicAnti forensic
Anti forensicMilap Oza
 
Cyber forensics
Cyber forensicsCyber forensics
Cyber forensicspranjal dutta
 
Network Forensics Intro
Network Forensics IntroNetwork Forensics Intro
Network Forensics IntroJake K.
 
Digital&computforensic
Digital&computforensicDigital&computforensic
Digital&computforensicRahul Badekar
 
Database forensics
Database forensicsDatabase forensics
Database forensicsDenys A. Flores, PhD
 
Cloud Forensics
Cloud ForensicsCloud Forensics
Cloud Forensicssdavis532
 
Collecting and preserving digital evidence
Collecting and preserving digital evidenceCollecting and preserving digital evidence
Collecting and preserving digital evidenceOnline
 
Cyber Security Services & Solutions - Zymr
Cyber Security Services & Solutions - ZymrCyber Security Services & Solutions - Zymr
Cyber Security Services & Solutions - ZymrZYMR, INC.
 
Zymr Cybersecurity
Zymr Cybersecurity Zymr Cybersecurity
Zymr Cybersecurity Zymr Inc
 

More Related Content

What's hot

Digital forensics
Digital forensics Digital forensics
Digital forensics vishnuv43
 
Cyber Forensics Overview
Cyber Forensics OverviewCyber Forensics Overview
Cyber Forensics OverviewYansi Keim
 
Introduction to computer forensic
Introduction to computer forensicIntroduction to computer forensic
Introduction to computer forensicOnline
 
Legal aspects of digital forensics
Legal aspects of digital forensics Legal aspects of digital forensics
Legal aspects of digital forensics KakshaPatel3
 
Preserving and recovering digital evidence
Preserving and recovering digital evidencePreserving and recovering digital evidence
Preserving and recovering digital evidenceOnline
 
MSAB XRY ver.9.4 and XAMN ver. 6.pdf
MSAB XRY ver.9.4 and XAMN ver. 6.pdfMSAB XRY ver.9.4 and XAMN ver. 6.pdf
MSAB XRY ver.9.4 and XAMN ver. 6.pdfRASLAKK
 
Anti forensic
Anti forensicAnti forensic
Anti forensicMilap Oza
 
Network Forensics Intro
Network Forensics IntroNetwork Forensics Intro
Network Forensics IntroJake K.
 
Digital&computforensic
Digital&computforensicDigital&computforensic
Digital&computforensicRahul Badekar
 
Cloud Forensics
Cloud ForensicsCloud Forensics
Cloud Forensicssdavis532
 
Collecting and preserving digital evidence
Collecting and preserving digital evidenceCollecting and preserving digital evidence
Collecting and preserving digital evidenceOnline
 

What's hot (20)

Digital forensics
Digital forensics Digital forensics
Digital forensics
 
Digital Forensics
Digital ForensicsDigital Forensics
Digital Forensics
 
Cyber Forensics Overview
Cyber Forensics OverviewCyber Forensics Overview
Cyber Forensics Overview
 
Mobile Forensics
Mobile Forensics Mobile Forensics
Mobile Forensics
 
Digital Forensic
Digital ForensicDigital Forensic
Digital Forensic
 
Introduction to computer forensic
Introduction to computer forensicIntroduction to computer forensic
Introduction to computer forensic
 
Cyber crime and forensic
Cyber crime and forensicCyber crime and forensic
Cyber crime and forensic
 
Network forensic
Network forensicNetwork forensic
Network forensic
 
Current Forensic Tools
Current Forensic Tools Current Forensic Tools
Current Forensic Tools
 
Legal aspects of digital forensics
Legal aspects of digital forensics Legal aspects of digital forensics
Legal aspects of digital forensics
 
Preserving and recovering digital evidence
Preserving and recovering digital evidencePreserving and recovering digital evidence
Preserving and recovering digital evidence
 
MSAB XRY ver.9.4 and XAMN ver. 6.pdf
MSAB XRY ver.9.4 and XAMN ver. 6.pdfMSAB XRY ver.9.4 and XAMN ver. 6.pdf
MSAB XRY ver.9.4 and XAMN ver. 6.pdf
 
Intro to cyber forensics
Intro to cyber forensicsIntro to cyber forensics
Intro to cyber forensics
 
Anti forensic
Anti forensicAnti forensic
Anti forensic
 
Cyber forensics
Cyber forensicsCyber forensics
Cyber forensics
 
Network Forensics Intro
Network Forensics IntroNetwork Forensics Intro
Network Forensics Intro
 
Digital&computforensic
Digital&computforensicDigital&computforensic
Digital&computforensic
 
Database forensics
Database forensicsDatabase forensics
Database forensics
 
Cloud Forensics
Cloud ForensicsCloud Forensics
Cloud Forensics
 
Collecting and preserving digital evidence
Collecting and preserving digital evidenceCollecting and preserving digital evidence
Collecting and preserving digital evidence
 

Similar to INTRODUCTION TO CYBER FORENSICS

Cyber Security Services & Solutions - Zymr
Cyber Security Services & Solutions - ZymrCyber Security Services & Solutions - Zymr
Cyber Security Services & Solutions - ZymrZYMR, INC.
 
Zymr Cybersecurity
Zymr Cybersecurity Zymr Cybersecurity
Zymr Cybersecurity Zymr Inc
 
Mobile Security Assessment
Mobile Security AssessmentMobile Security Assessment
Mobile Security AssessmentSylvain Martinez
 
CONFidence2015: Real World Threat Hunting - Martin Nystrom
CONFidence2015: Real World Threat Hunting - Martin NystromCONFidence2015: Real World Threat Hunting - Martin Nystrom
CONFidence2015: Real World Threat Hunting - Martin NystromPROIDEA
 
GDG Cloud Southlake #4 Biodun Awojobi and Wade Walters Security Programs and ...
GDG Cloud Southlake #4 Biodun Awojobi and Wade Walters Security Programs and ...GDG Cloud Southlake #4 Biodun Awojobi and Wade Walters Security Programs and ...
GDG Cloud Southlake #4 Biodun Awojobi and Wade Walters Security Programs and ...James Anderson
 
Exploring the Defender's Advantage
Exploring the Defender's AdvantageExploring the Defender's Advantage
Exploring the Defender's AdvantageRaffael Marty
 
SEB Forcepoint Corporate Overview
SEB Forcepoint Corporate OverviewSEB Forcepoint Corporate Overview
SEB Forcepoint Corporate OverviewStephen Bates
 
Disrupting the Malware Kill Chain - What's New from Palo Alto Networks.
Disrupting the Malware Kill Chain - What's New from Palo Alto Networks.Disrupting the Malware Kill Chain - What's New from Palo Alto Networks.
Disrupting the Malware Kill Chain - What's New from Palo Alto Networks.Scalar Decisions
 
Marlabs cyber threat management
Marlabs cyber threat managementMarlabs cyber threat management
Marlabs cyber threat managementRajendra Menon
 
CV-SMB-infographic-small
CV-SMB-infographic-smallCV-SMB-infographic-small
CV-SMB-infographic-smallJeff Geissler
 
Journey to the Center of Security Operations
Journey to the Center of Security OperationsJourney to the Center of Security Operations
Journey to the Center of Security Operations♟Sergej Epp
 
Evolutionary ATM & Cyber Security - Selex ES - Angeloluca Barba
Evolutionary ATM & Cyber Security - Selex ES - Angeloluca BarbaEvolutionary ATM & Cyber Security - Selex ES - Angeloluca Barba
Evolutionary ATM & Cyber Security - Selex ES - Angeloluca BarbaAngeloluca Barba
 
Cisco Security Architecture
Cisco Security ArchitectureCisco Security Architecture
Cisco Security ArchitectureCisco Canada
 
8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security
8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security
8 Ocak 2015 SOME Etkinligi - Cisco Next Generation SecurityBGA Cyber Security
 
INCIDENT RESPONSE OVERVIEW
INCIDENT RESPONSE OVERVIEWINCIDENT RESPONSE OVERVIEW
INCIDENT RESPONSE OVERVIEWSylvain Martinez
 
Next Generation Firewall and IPS
Next Generation Firewall and IPSNext Generation Firewall and IPS
Next Generation Firewall and IPSData#3 Limited
 
Cybersecurity Risk from User Perspective
Cybersecurity Risk from User PerspectiveCybersecurity Risk from User Perspective
Cybersecurity Risk from User PerspectiveAvinantaTarigan
 

Similar to INTRODUCTION TO CYBER FORENSICS (20)

Cyber Security Services & Solutions - Zymr
Cyber Security Services & Solutions - ZymrCyber Security Services & Solutions - Zymr
Cyber Security Services & Solutions - Zymr
 
Zymr Cybersecurity
Zymr Cybersecurity Zymr Cybersecurity
Zymr Cybersecurity
 
Mobile Security Assessment
Mobile Security AssessmentMobile Security Assessment
Mobile Security Assessment
 
OFFENSIVE IDS
OFFENSIVE IDSOFFENSIVE IDS
OFFENSIVE IDS
 
CONFidence2015: Real World Threat Hunting - Martin Nystrom
CONFidence2015: Real World Threat Hunting - Martin NystromCONFidence2015: Real World Threat Hunting - Martin Nystrom
CONFidence2015: Real World Threat Hunting - Martin Nystrom
 
GDG Cloud Southlake #4 Biodun Awojobi and Wade Walters Security Programs and ...
GDG Cloud Southlake #4 Biodun Awojobi and Wade Walters Security Programs and ...GDG Cloud Southlake #4 Biodun Awojobi and Wade Walters Security Programs and ...
GDG Cloud Southlake #4 Biodun Awojobi and Wade Walters Security Programs and ...
 
Exploring the Defender's Advantage
Exploring the Defender's AdvantageExploring the Defender's Advantage
Exploring the Defender's Advantage
 
SEB Forcepoint Corporate Overview
SEB Forcepoint Corporate OverviewSEB Forcepoint Corporate Overview
SEB Forcepoint Corporate Overview
 
Disrupting the Malware Kill Chain - What's New from Palo Alto Networks.
Disrupting the Malware Kill Chain - What's New from Palo Alto Networks.Disrupting the Malware Kill Chain - What's New from Palo Alto Networks.
Disrupting the Malware Kill Chain - What's New from Palo Alto Networks.
 
Marlabs cyber threat management
Marlabs cyber threat managementMarlabs cyber threat management
Marlabs cyber threat management
 
CV-SMB-infographic-small
CV-SMB-infographic-smallCV-SMB-infographic-small
CV-SMB-infographic-small
 
Journey to the Center of Security Operations
Journey to the Center of Security OperationsJourney to the Center of Security Operations
Journey to the Center of Security Operations
 
Evolutionary ATM & Cyber Security - Selex ES - Angeloluca Barba
Evolutionary ATM & Cyber Security - Selex ES - Angeloluca BarbaEvolutionary ATM & Cyber Security - Selex ES - Angeloluca Barba
Evolutionary ATM & Cyber Security - Selex ES - Angeloluca Barba
 
SecureData GI
SecureData GISecureData GI
SecureData GI
 
Cisco Security Architecture
Cisco Security ArchitectureCisco Security Architecture
Cisco Security Architecture
 
8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security
8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security
8 Ocak 2015 SOME Etkinligi - Cisco Next Generation Security
 
INCIDENT RESPONSE OVERVIEW
INCIDENT RESPONSE OVERVIEWINCIDENT RESPONSE OVERVIEW
INCIDENT RESPONSE OVERVIEW
 
Conférence ENGIE ACSS 2018
Conférence ENGIE ACSS 2018 Conférence ENGIE ACSS 2018
Conférence ENGIE ACSS 2018
 
Next Generation Firewall and IPS
Next Generation Firewall and IPSNext Generation Firewall and IPS
Next Generation Firewall and IPS
 
Cybersecurity Risk from User Perspective
Cybersecurity Risk from User PerspectiveCybersecurity Risk from User Perspective
Cybersecurity Risk from User Perspective
 

More from Sylvain Martinez

PROGRAMMING AND CYBER SECURITY
PROGRAMMING AND CYBER SECURITYPROGRAMMING AND CYBER SECURITY
PROGRAMMING AND CYBER SECURITYSylvain Martinez
 
INTRODUCTION TO CRYPTOGRAPHY
INTRODUCTION TO CRYPTOGRAPHYINTRODUCTION TO CRYPTOGRAPHY
INTRODUCTION TO CRYPTOGRAPHYSylvain Martinez
 
INCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONINCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONSylvain Martinez
 
DATA LOSS PREVENTION OVERVIEW
DATA LOSS PREVENTION OVERVIEWDATA LOSS PREVENTION OVERVIEW
DATA LOSS PREVENTION OVERVIEWSylvain Martinez
 
2019 CYBER SECURITY TRENDS REPORT REVIEW
2019 CYBER SECURITY TRENDS REPORT REVIEW2019 CYBER SECURITY TRENDS REPORT REVIEW
2019 CYBER SECURITY TRENDS REPORT REVIEWSylvain Martinez
 
INCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSINCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSSylvain Martinez
 
VIRTUAL CISO AND OTHER KEY CYBER ROLES
VIRTUAL CISO AND OTHER KEY CYBER ROLESVIRTUAL CISO AND OTHER KEY CYBER ROLES
VIRTUAL CISO AND OTHER KEY CYBER ROLESSylvain Martinez
 
Talk1 esc7 muscl-gdpr_debate_v1_2
Talk1 esc7 muscl-gdpr_debate_v1_2Talk1 esc7 muscl-gdpr_debate_v1_2
Talk1 esc7 muscl-gdpr_debate_v1_2Sylvain Martinez
 
Talk1 esc7 muscl-dataprotection_v1_2
Talk1 esc7 muscl-dataprotection_v1_2Talk1 esc7 muscl-dataprotection_v1_2
Talk1 esc7 muscl-dataprotection_v1_2Sylvain Martinez
 
INCIDENT HANDLING IN ORGANISATIONS
INCIDENT HANDLING IN ORGANISATIONSINCIDENT HANDLING IN ORGANISATIONS
INCIDENT HANDLING IN ORGANISATIONSSylvain Martinez
 
SOCIAL MEDIA AS A CYBER WEAPON
SOCIAL MEDIA AS A CYBER WEAPONSOCIAL MEDIA AS A CYBER WEAPON
SOCIAL MEDIA AS A CYBER WEAPONSylvain Martinez
 

More from Sylvain Martinez (20)

PROGRAMMING AND CYBER SECURITY
PROGRAMMING AND CYBER SECURITYPROGRAMMING AND CYBER SECURITY
PROGRAMMING AND CYBER SECURITY
 
INTRODUCTION TO CRYPTOGRAPHY
INTRODUCTION TO CRYPTOGRAPHYINTRODUCTION TO CRYPTOGRAPHY
INTRODUCTION TO CRYPTOGRAPHY
 
INCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATIONINCIDENT RESPONSE NIST IMPLEMENTATION
INCIDENT RESPONSE NIST IMPLEMENTATION
 
DATA LOSS PREVENTION OVERVIEW
DATA LOSS PREVENTION OVERVIEWDATA LOSS PREVENTION OVERVIEW
DATA LOSS PREVENTION OVERVIEW
 
2019 CYBER SECURITY TRENDS REPORT REVIEW
2019 CYBER SECURITY TRENDS REPORT REVIEW2019 CYBER SECURITY TRENDS REPORT REVIEW
2019 CYBER SECURITY TRENDS REPORT REVIEW
 
INCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTSINCIDENT RESPONSE CONCEPTS
INCIDENT RESPONSE CONCEPTS
 
PHISHING PROTECTION
PHISHING PROTECTIONPHISHING PROTECTION
PHISHING PROTECTION
 
VIRTUAL CISO AND OTHER KEY CYBER ROLES
VIRTUAL CISO AND OTHER KEY CYBER ROLESVIRTUAL CISO AND OTHER KEY CYBER ROLES
VIRTUAL CISO AND OTHER KEY CYBER ROLES
 
IOT Security
IOT SecurityIOT Security
IOT Security
 
ARE YOU RED TEAM READY?
ARE YOU RED TEAM READY?ARE YOU RED TEAM READY?
ARE YOU RED TEAM READY?
 
GDPR SECURITY ISSUES
GDPR SECURITY ISSUESGDPR SECURITY ISSUES
GDPR SECURITY ISSUES
 
The Art of CTF
The Art of CTFThe Art of CTF
The Art of CTF
 
OFFICE 365 SECURITY
OFFICE 365 SECURITYOFFICE 365 SECURITY
OFFICE 365 SECURITY
 
Risk on Crypto Currencies
Risk on Crypto CurrenciesRisk on Crypto Currencies
Risk on Crypto Currencies
 
Talk1 esc7 muscl-gdpr_debate_v1_2
Talk1 esc7 muscl-gdpr_debate_v1_2Talk1 esc7 muscl-gdpr_debate_v1_2
Talk1 esc7 muscl-gdpr_debate_v1_2
 
Talk1 esc7 muscl-dataprotection_v1_2
Talk1 esc7 muscl-dataprotection_v1_2Talk1 esc7 muscl-dataprotection_v1_2
Talk1 esc7 muscl-dataprotection_v1_2
 
Ethical Hacking
Ethical HackingEthical Hacking
Ethical Hacking
 
INCIDENT HANDLING IN ORGANISATIONS
INCIDENT HANDLING IN ORGANISATIONSINCIDENT HANDLING IN ORGANISATIONS
INCIDENT HANDLING IN ORGANISATIONS
 
SOCIAL MEDIA AS A CYBER WEAPON
SOCIAL MEDIA AS A CYBER WEAPONSOCIAL MEDIA AS A CYBER WEAPON
SOCIAL MEDIA AS A CYBER WEAPON
 
Talk2 esc4 muscl-ids_v1_2
Talk2 esc4 muscl-ids_v1_2Talk2 esc4 muscl-ids_v1_2
Talk2 esc4 muscl-ids_v1_2
 

Recently uploaded

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10
 
Apidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu
Apidays Singapore 2024 - Modernizing Securities Finance by Madhu SubbuApidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu
Apidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbuapidays
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...apidays
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc
 
Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...
Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...
Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...apidays
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherRemote DBA Services
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodJuan lago vázquez
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingEdi Saputra
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?Igalia
 
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Zilliz
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAndrey Devyatkin
 
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...Zilliz
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxRustici Software
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesrafiqahmad00786416
 
MS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsMS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsNanddeep Nachan
 
Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot ModelNavi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot ModelDeepika Singh
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Miguel Araújo
 

Recently uploaded (20)

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Apidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu
Apidays Singapore 2024 - Modernizing Securities Finance by Madhu SubbuApidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu
Apidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...
Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...
Apidays Singapore 2024 - Scalable LLM APIs for AI and Generative AI Applicati...
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
Emergent Methods: Multi-lingual narrative tracking in the news - real-time ex...
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptx
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
MS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsMS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectors
 
Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot ModelNavi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 

INTRODUCTION TO CYBER FORENSICS

  • 1. {elysiumsecurity} INTRODUCTION TO CYBER FORENSICS Version: 1.3a Date: 04/07/2018 Author: Sylvain Martinez Reference: ESC6-MUSCL Classification: Public cyber protection & response
  • 2. {elysiumsecurity} cyber protection & response 2 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT • Core Principles; • Client Database Leak Investigation. CONTENTS Public • Definitions • Cyber Attacks and M alware trends; • GDPR Requirem ents; • Overview; • Goals; • Actions; • Activity Scope;
  • 3. {elysiumsecurity} cyber protection & response 3 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT DEFINITIONS Public FOREENSIC SCIENCE THE APPLICATION OF SCIENCE TO CRIMINAL AND CIVIL LAWS, DURING CRIMINAL INVESTIGATION, AS GOVERNED BY THE LEGAL STANDARDS OF ADMISSIBLE EVIDENCE AND CRIMINAL PROCEDURE. Definitions from Wikipedia DIGITAL FORENSICS A BRANCH OF FORENSIC SCIENCE ENCOMPASSING THE RECOVERY AND INVESTIGATION OF MATERIAL FOUND IN DIGITAL DEVICES, OFTEN IN RELATION TO COMPUTER CRIME CYBER/COMPUTER FORENSICS A BRANCH OF DIGITAL FORENSIC SCIENCE, THE APPLICATION OF INVESTIGATION AND ANALYSIS TECHNIQUES TO GATHER AND PRESERVE EVIDENCE FROM A PARTICULAR COMPUTING DEVICE IN A WAY THAT IS SUITABLE FOR PRESENTATION IN A COURT OF LAW
  • 4. {elysiumsecurity} cyber protection & response 4 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT CYBER ATTACKS AND MALWARE TRENDS Public Source: AV-TEST
  • 5. {elysiumsecurity} cyber protection & response 5 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT GDPR REQUIREMENTS Public ARTICLE 33 72H REPORTING NATURE OF THE BREACH? (WHO? WHERE? HOW?) POTENTIAL IMPACT? WHAT HAS BEEN DONE TO PREVENT THE BREACH? (CONTROLS? PROCESSES?) Icons from the Noun Project unless specified otherwise
  • 6. {elysiumsecurity} cyber protection & response 6 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT CORE PRINCIPLES Public PRESERVATION OF INTEGRITY CHAIN OF CUSTODY ONLINE/OFFLINE ? NEVER FORGET THE « S »!! ACTIVITY GOALS
  • 7. {elysiumsecurity} cyber protection & response 7 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT OVERVIEW Public CONTEXT LOGS FILESYSTEM CONFIG NETWORK MEMORY ADVANCED ACTIVITY SCOPE ACQUISITION ANALYSIS REPORTINGACTIONS GOALS IDENTIFICATION Impact/Target/Technique ATTRIBUTION Source of Attack COLLECTION Evidence of compromise Copyright ELYSIUMSECURITY LTD, please refer to us if reusing this diagram: https://www.elysiumsecurity.com
  • 8. {elysiumsecurity} cyber protection & response 8 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT GOALS Public IDENTIFICATION Impact/Target/Technique ATTRIBUTION Source of Attack COLLECTION Evidence of compromise WHAT? WAS COMPROMISED? WAS STOLEN/MODIFIED? WHERE? THE CONTROLS FAILED? THE DATA WENT? HOW? THEY HACKED? WAS IT STOPPED? WHY? THEY TARGETED YOU? WAS IT SUCCESSFUL? WHO? WAS TARGETED? WAS RESPONSIBLE?
  • 9. {elysiumsecurity} cyber protection & response 9 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIONS Public ACQUISITION REPORTING ANALYSIS IDENTIFICATION OF EVIDENCE PRESERVATION OF EVIDENCE COLLECTION OF EVIDENCE ANALYSIS OF EVIDENCE DOCUMENTATION OF EVIDENCE PRESENTATION OF EVIDENCE
  • 10. {elysiumsecurity} cyber protection & response 10 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - CONTEXT Public CONTEXT TIMELINE LOCATION MEDIUM INDIVIDUALS ACTIVITIES READ-ONLY COPY OF EVIDENCE ! INTERVIEWS
  • 11. {elysiumsecurity} cyber protection & response 11 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - LOG Public LOGS ENDPOINTS SERVERS NETWORK DEVICES CLOUD SERVICES EVENT VIEWER, WEBTOOLS START WITH TIMELINE RANGE READ-ONLY COPY OF EVIDENCE !
  • 12. {elysiumsecurity} cyber protection & response 12 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - FILESYSTEM Public FILESYSTEM SUPER TIMELINE FILE/APP/KEYWORD SEARCH PLACES OF INTEREST VIRUS SCANS LOG2TIMELINE, TSK HUGE AMOUNT OF DATA READ-ONLY COPY OF EVIDENCE !
  • 13. {elysiumsecurity} cyber protection & response 13 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - CONFIG Public CONFIG REGISTRY KEY HIVE SYSTEM FILES APPLICATION CONFIGURATION RECENT CHANGES/INSTALLATIONS REGEDIT/HIJACKTHIS/GREP READ-ONLY COPY OF EVIDENCE !
  • 14. {elysiumsecurity} cyber protection & response 14 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - NETWORK Public NETWORK SOURCE / DESTINATION ACTIVITIES PROTOCOL USED TRAFFIC CONTENT ANALYSIS IDS ANALYSIS WIRESHARK / TCPDUMP READ-ONLY COPY OF EVIDENCE !
  • 15. {elysiumsecurity} cyber protection & response 15 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - MEMORY Public MEMORY DUMP MEMORY / PAGE FILES RUNNING PROCESSES BINARY INSPECTION HIDDEN DATA VOLATILITY / REKAL READ-ONLY COPY OF EVIDENCE !
  • 16. {elysiumsecurity} cyber protection & response 16 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT ACTIVITY - ADVANCED Public ADVANCED USER ACTIVITY SIMULATION MALWARE REVERSE ENGINEERING MALWARE SANDBOXING HONEYPOTS HACKER COMMUNICATION DANGEROUS!READ-ONLY COPY OF EVIDENCE !
  • 17. {elysiumsecurity} cyber protection & response 17 CASE STUDYFRAMEWORKPRINCIPLESCONTEXT CLIENT DATABASE LEAK INVESTIGATION Public CONTEXT LOG FILESYSTEM CONFIG NETWORK MEMORY ADVANCED - EXECUTIVE ATTENDED A CONFERENCE; - LOGGED TO WEBMAIL; - WARNING IGNORED; - CLIENT DB LEAKED; - 29/05/18 @ 09:09 - TROJAN FILES FOUND; - HIDDEN PARTITION IDENTIFIED; - BAD WEB PLUGIN DELETED; - USB CONNECTION. - PROCESS SENDING DATA TO IP EVERY 5 MINUTES; - ENDPOINT ACTING AS A PROXY FOR INTRANET; - IDS FLAG ALERTS. - MALWARE SOURCE CODE IN FRENCH; - IP TRAIL FROM KNOWN GROUPS; - HACKER FOR HIRE FROM EX EMPLOYEE. - EMAIL LOGING FROM SUSPICIOUS COUNTRY; - EMAIL DELETED TO DB SUPPORT; - VPN ACCESS FROM CONFERENCE. - WEB HISTORY TO FAKE WEBMAIL; - FIREWALL TURNED OFF; - AV WHITELIST OF SUSPICIOUS DIRECTORY; - SUSPICIOUS SERVICE. - HIDDEN PROCESSES; - TROJAN DETECTED IN MEMORY; - REMOTE CONNECTION LIVE;
  • 18. {elysiumsecurity} cyber protection & response © 2018 Elysium Security Ltd. All Rights Reserved www.elysium security.com ElysiumSecurity provides practical expertise to identify vulnerabilities, assess their risks and impact, remediate those risks, prepare and respond to incidents as well as raise security awareness through an organization. ElysiumSecurity provides high level expertise gathered through years of best practices experience in large international companies allowing us to provide advice best suited to your business operational model and priorities. ABOUT ELYSIUMSECURITY LTD. ElysiumSecurity provides a portfolio of Strategic and Tactical Services to help companies protect and respond against Cyber Security Threats. We differentiate ourselves by offering discreet, tailored and specialized engagements. Operating in Mauritius and in the United Kingdom, our boutique style approach means we can easily adapt to your business operational model and requirements to provide a personalized service that fits your working environment.