Recommended
More Related Content
What's hot
What's hot (19)
Similar to Cyber Threat 2019 NCSC-SANS London Conference - Mandiant IR Practitioners Guide
Similar to Cyber Threat 2019 NCSC-SANS London Conference - Mandiant IR Practitioners Guide (20)
Recently uploaded
Recently uploaded (20)
Cyber Threat 2019 NCSC-SANS London Conference - Mandiant IR Practitioners Guide
- 1. Tom Hall & Mitch Clarke Incident Response Practitioner’s Guide:
- 2. ©2019 FireEye Mandiant©2019 FireEye Mandiant § Principal Consultant – FireEye Mandiant, Incident Response – 4 years – thall_sec Tom Hall 2 § Senior Consultant – FireEye Mandiant, Incident Response – 2 years – snozberries_au Mitch Clarke
- 3. ©2019 FireEye Mandiant©2019 FireEye Mandiant Case studies and examples are drawn from our experiences and activities working for a variety of customers, and do not represent our work for any one customer or set of customers. In many cases, facts have been changed to obscure the identity of our customers and individuals associated with our customers. Disclosure Statement 3
- 4. ©2019 FireEye Mandiant©2019 FireEye Mandiant § We’re sharing: – Experiences from real-world incidents – Lessons we’ve learnt – Mistakes we’ve seen organisations make – Our approach to enterprise incident response Topics 4
- 5. ©2019 FireEye Mandiant©2019 FireEye Mandiant5 § Complex intrusions: – Nation-state affiliated APT groups – Financial crime groups § Where attackers are: – Entrenched – Privileged – Motivated Context
- 6. ©2019 FireEye Mandiant©2019 FireEye Mandiant § Most organisations are not experienced in APT intrusions § Organisations vary in their maturity and ability § BAU IR can be counterproductive in an APT intrusion BAU IR vs Complex Intrusions 6
- 8. ©2019 FireEye Mandiant©2019 FireEye Mandiant § Good engagement setup is the most critical phase of a successful IR: Make or Break 8
- 9. ©2019 FireEye Mandiant©2019 FireEye Mandiant § Determine the maturity of the organisation § Understand complexity of their network § Consider current lead/known malicious activity § Grasp the organisational structure and politics § Tailor the response approach for the organisation Setup Considerations 9
- 11. ©2019 FireEye Mandiant©2019 FireEye Mandiant § Explain the attacker lifecycle and motivations § Intrusions (typically): – Are larger than victims expect – First alert doesn’t mean first activity § If data-theft is the goal, it’s usually already happened § The attackers are real people who can solve problems Walk Through a Typical APT/FIN Intrusion 11
- 12. ©2019 FireEye Mandiant©2019 FireEye Mandiant Describe the IR and Remediation Journey 12 § It’s a marathon, not a sprint § No organisation can go from initial tip off/discovery to effective eradication without: – Understanding what access the attacker retains – Improving the security posture of the network to eradicate and survive immediate re-compromise
- 13. ©2019 FireEye Mandiant©2019 FireEye Mandiant § Remediation efforts should begin at the same time as the IR § As the IR progresses, we’ll learn about attacker tradecraft and extent of the breach – Remediation efforts can begin to be targeted – Eradication planning can begin § Once we understand access, it’s time to eradicate § Remediation must continue after eradication: – Medium and long term security architecture and culture changes Describe the IR and Remediation Journey 13
- 14. ©2019 FireEye Mandiant©2019 FireEye Mandiant § Poorly scoped or insufficient tooling deployment can create blind-spots in the investigation and safe-harbours for attackers to retain access – Can render an eradication completely ineffective Do IR Once, do it Right 14
- 15. ©2019 FireEye Mandiant©2019 FireEye Mandiant § “We cannot allow you to investigate our <Special/Sensitive/Critical> networks because they’re <Special/Sensitive/Critical> to our business” § If it’s critical to the business, it’s critical to the attacker § Attackers will learn how your admins maintain the environment § Be sure to understand what the business does and why an attacker might be there Why are the attackers here? 15
- 16. ©2019 FireEye Mandiant©2019 FireEye Mandiant § The organisation will typically need to establish an incident response team, which can consist of: – Lead – Project manager – IT/technical lead – Legal, Privacy, Risk, and/or Governance – Communications § Remediation team is also required § Teams are most successful when leader has enough business knowledge and political capital to move fast and be far-reaching Dedicated Teams are Required 16
- 17. ©2019 FireEye Mandiant©2019 FireEye Mandiant § Buy-in and support of IT is essential for success of incident response § You need to protect IT resources from burnout – Learn the client culture § Large networks will always have issues § Save-face for IT – Always under-funded – Lack of human resources – Motivated attackers will always keep trying until they’re successful Build Trust with IT 17
- 18. ©2019 FireEye Mandiant©2019 FireEye Mandiant § Frequency § Seniority § Number of stakeholders Communications Rhythm 18
- 19. ©2019 FireEye Mandiant©2019 FireEye Mandiant § Historical activity § Impactful findings – Data theft – Targeting of specific systems § An active attacker – What can we do? – What is effective? – Where should we spend our resources? How to Handle Investigation Findings 19
- 20. ©2019 FireEye Mandiant©2019 FireEye Mandiant § Enterprise networks typically convoluted and systems interdependent § Real/effective containment will usually: – Break your application – Prevent users from doing business § Doesn’t stop the attacker from accessing victim network § Burns resources of IT § Containment is effective for hours, that’s all. Containment 20
- 22. ©2019 FireEye Mandiant©2019 FireEye Mandiant § Not a science § No one size fits all § There’s a balance in everything Always Tailor for your Victim Organisation 22
- 23. Thank You