This document provides an overview of incident response. It defines a security incident, lists common incident categories and the intrusion process. It discusses common cyber threats in 2010 like malware, botnets, and cybercrime-as-a-service business models. The document outlines the stages of incident response, types of digital evidence, and strategies to prevent incidents like scanning, auditing, deploying intrusion detection/prevention systems, and establishing defense in depth. It provides examples of incident response forms and discusses challenges of digital evidence analysis.

1. Incident Response
Roberto Martínez
Owner – Consultant ITlligent Security
Certified EC Council Instructor Latam
CEH, ECSA, ENSA, CHFI, EDRP, ECVP, PMIT, ECSP
MCT, MCSE, MCAD, MCTS, MCSA, Security+

2. Agenda
• Security Incidents
• Cyber Threats
• Incident response
• Digital Evidence
• How to prevent an Incident

3. Incident
Computer security incident is defined as
“Any real or suspected adverse event in
relation to the security of computer systems or
computer networks.”

4. Incidents include:
• Violation of an explicit or implied security policy
• Attempts to gain unauthorized access
• Unwanted denial of resources
• Unauthorized use of electronic resources

5. Incident Categories

6. High Impact Incidents

7. The intrusion process

8. Cyber Threats in 2010
Malware
Data thefts Botnets
Threats to
Cyber VOIP and
warfare mobile
convergence

9. Cybercrime-as-a-Service (CaaS)
market model.
September, 2009’s “Measuring the in-the-wild effectiveness of Antivirus
against Zeus” report by Trusteer, indicated that “the effectiveness of an up to
date anti virus against Zeus is thus not 100%, not 90%, not even 50% - it’s
just 23%.” meaning that cybercriminals have clearly started excelling into the
practice of bypassing signature-based malware scanners.

10. Incident Response
Well Defined set of procedures that address
the post incident scenario.
An Incident Response Plan includes:
• Immediate action
• Investigation
• Restoration of resources
• Reporting the incident to proper channels.

11. Incident Handling
Incident handling helps to find out trends
and pattern regarding intruder activity by
analyzing it.
• It involves three basic functions:
Incident reporting
Incident Analysis
Incident Response

12. Security Incident Response Form

13. Digital Evidence
• Digital evidence is defined as “any information of
probative value that is either stored or transmitted in
a digital form.”
Digital evidence is found in the files, such as:
– Graphic files
– Audio and video recording and files
– Web browser history
– Server logs
– Word processing and spreadsheet files
– E-mails
– Log files

14. Challenging Aspects of Digital
Evidence
• Digital evidence are fragile in nature
• During the investigation of the crime scene, if the computer is
turned off, the data which is not saved can be lost permanently.
• During the investigation, digital evidence can be altered
maliciously or unintentionally without leaving any clear signs of
alteration.
• Digital evidence is circumstantial that makes it difficult for the
forensics investigator to differentiate the system´s activity.
• After the incident, if a user writes some data to the system, it
may overwrite the crime scene.

15. Forensic Policy
• Forensic policy is a set of procedures
describing the actions to be taken when an
incident is observed.
• It defines the roles and responsibilities of all
people performing or assisting the forensic
activities.
• It should include all internal and external
parties that may be involved.
• It explains what actions should and should not
be performed under normal and special
conditions.

16. Forensic Analysis Guidelines
Organizations should:
• Have a capability to perform computer and network forensics
• Determine which parties should handle each aspect of forensics
• Create and maintain guidelines and procedures for performing forensic
tasks
• Perform forensics using a consistent process
• Be proactive in collecting useful data
• Adhere to standard operating procedure as specified by local laws and
standard making bodies such as IOCE & SWGDE while collecting evidence

17. How to prevent an incident
A key to preventing security incident is to eliminate
as many vulnerabilities as possible.
• Scanning the network
• Auditing the network
• Deploying Intrusion Detection / Prevention
systems
• Establishing Defense in Depth

18. Normalization
Security monitoring environment is multi-vendor
Events from different devices and vendors have different formats
Need to compare similar—normalized—events from multiple vendors
“apples-to-apples”

19. Event Correlation
 Log/Alert  
 
 
 
   
 
Firewall
 Logs


   
 
 
 NIDS Logs 
   

   

 
  
 
  

20. Log Consolidation
A defense in depth strategy utilizes multiple devices
Firewalls, NIPS, HIPS, AV, AAA, VPN, Application Events, OS Logs
Need to consolidate and normalize similar events from multiple vendors
Universal SYSLOG support
AAA

21. Threat Correlation – Post
Incident Analysis (IV)
Post incident analysis to adjust incident severity
based on context
Did the attack reach destination?
Is the victim vulnerable?
How important is the victim system?
Further events indicated a possible compromise?
Analysis can be static or dynamic

22. Demo

23. Resources
Certifications
EC Council Certified Incident Handler
• http://www.eccouncil.org/certification/ec-council_certified_incident_handler.aspx
Computer Hacking Forensic Investigator
• http://www.eccouncil.org/certification/computer_hacking_forensic_investigator.aspx
Concepti
• http://www.concepti.com
Tools
XPLICO - Internet Traffic Decoder. Network Forensic Analysis Tool (NFAT)
• http://www.xplico.org/
Netwitness - Threat management solutions, monitoring and real-time network forensics.
• http://www.netwitness.com/
OSSIM - Open Source Security Information Management
• http://www.alienvault.com/community.php?section=Home
Web Sites
FIRST is the global Forum for Incident Response and Security Teams
• http://www.first.org/

24. Questions
?

25. Thank you!
Roberto Martínez
ITlligent Security
Email: roberto.martinez@itlligent.com.mx
MSN: frml@live.com.mx
Skype: skp_roberto.martinez
@r0bertmart1nez