Incident Response Triage

5th Annual HTCIA Asia Pacific Conference
7th December, 2011 @ Hong Kong

Enterprises’ Dilemma

INCIDENT RESPONSE TRIAGE

Albert Hui, GREM, GCFA, GCFE, GCIA, GCIH, GAWN, GSNA, CISA

Who am I?
Albert Hui
GREM, GCFA, GCFE, GCIA, GCIH, GAWN, GSNA, CISA

 Member of:
 SANS Advisory Board
 Digital Phishnet
 ACFE
 Consulted for setting up IR capabilities
at critical infrastructure companies.
 Former incident analyst / threat
researcher at top-tier retail,
commercial, and investment banks.
 Dropped out of PhD to run a startup
making IPS boxes.
 Now a security ronin .

Copyright © 2011 Albert Hui

Agenda

 The Context: IR process and Triage.
 Incident Verification: A Systematic Approach.
 Severity Assessment: A Potentiality Model.


Enterprises’ Dilemma

 Huge Volume
 Influx of Incidents
 Time Critical
 Horizontal vs. Vertical

 Triage!


Forensics vs. Incident Response


Forensics

Crime is suspected to have happened.

Did it happen?


Incident Response
1263906912.307 1884 192.168.1.120 TCP_MISS/200 24593
GET http://hezlhhh.co.cc/x22/load.php?spl=java_gsb&h= -
DIRECT/122.115.63.6 application/octet-stream

Alert tiggered.

What the hell just happened?

How serious was that?

How to deal with it?


Incident Response
1263906912.307 1884 192.168.1.120 TCP_MISS/200 24593
GET http://hezlhhh.co.cc/x22/load.php?spl=java_gsb&h= -
DIRECT/122.115.63.6 application/octet-stream

Alert tiggered.

What the hell just happened?
Triage! that?
How serious was

How to deal with it?


Where Does Triage Belong?

Lessons
Preparation Identification Containment Eradication Recovery
Learned

Report
Severity
(w/ Initial Severity) Verification Prioritization
Interpretation Assessment


Triage Stages

 Report (w/ Initial Severity) Interpretation
 Report typically came in as alerts (IDS, AV, SIEM, etc.)
 Alert rules typically assigned severity
 MSSP supposed to further tune severity with respect to
prevailing threat conditions
 Verification
 Is it material? (e.g. Serv-U alerts when no Serv-U installed)
 Severity Assessment
 Damage already done
 Potential for further damage
 Prioritization
 Deal with most severe cases first


Verification


What Tools Do We Need?
 log2timeline  auditpol
 autoruns  uassist_lv
 RegRipper  listdlls
 RipXP  dumpel
 RegScan  pclip
 FastDump  fport
 Volatility  tcpvcon
 mdd  md5deep
 Memoryze  ssdeep
 Red Curtain  F-Response
 Responder Pro  psexec
 FlyPaper  wft
 Recon  WireShark
 dcfldd  analyzeMFT


What Tools Do We Need?

If you got a hammer,
everything looks like a
nail.


Right Questions

The Alexious Principle
1. What question are you trying to answer?
2. What data do you need to answer that question?
3. How do you extract and analyze that data?
4. What does / would that data tell you?


Fault Tree


What Questions Are You
Trying to Answer?


What Questions Are You
Trying to Answer?

Breath-First Search


What Data Do You Need to
Answer that Question?


Guiding Principles

Locard’s Exchange Principle
 Every contact leaves a trace
Occam’s Razor
 Facts > Inferences
The Alexious Principle
1. What question are you trying to answer?
2. What data do you need to answer that question?
3. How do you extract and analyze that data?
4. What does / would that data tell you?

Severity Assessment
And Prioritization


Risk Revisited

Risk = Likelihood  Impact  Asset Value


Risk Revisited

Likelihood

Likelihood = 100%
(already happened)

Impact

Risk Revisited

Impact = Threat  Vulnerability


Oft-Neglected Dimension

Intensive
Care
Existing
Damage and
Scope

Standard Immediate
Mitigation Attention!
Potential
Damage and
Scope

Potential Scope and Damage

Artifact Compromised Malware
Hemisphere Entities Capability

Intellectual Exploit
Ease of Attack
Hemisphere Chainability

Know Know
Thyself Thy Enemy

Exploit Chainability

 Small immaterial weaknesses can combine to
become material.
 You have to know your systems and
configurations to assess.


Reason’s Swiss Cheese Model

From Duke University Medical Center


Ease of Attack


What Do Threat Analysts Need
to Know?
 Prevailing threat conditions
 e.g. pdf 0-day CVE-2011-2462 in the wild,
Adobe promises a fix “no later than the week of December
12, 2011”
 Current easiness / reliability to mount an attack.
 e.g. a certain exploit has just been committed to Metasploit
 Consequence of a compromise (chained exploit).
 Malware reverse engineering skills.
 Etc. etc.

Send them to conferences and trainings
like HTCIA!!


Conclusion
FTA Potentiality Model
Compromised Malware
Lessons
Preparation Identification Containment Eradication Recovery Capability
Entities
Learned

Exploit
Ease of Attack
Chainability

Report
Severity
(w/ Initial Severity) Verification Prioritization
Interpretation Assessment


Thank you!

albert@securityronin.com

Incident Response Triage

More Related Content

What's hot

Similar to Incident Response Triage

More from Albert Hui

Recently uploaded

Incident Response Triage