DFIR

• Incident Response

  • A typical incident response process goes beyond simply acknowledging and resolving an incident; it should involve a proactive and orchestrated effort to notify the right individuals, mobilise teams, and provide stakeholders with the information needed to facilitate collaboration.
  • A coordinated approach such as this allows organisations to respond to incidents quickly and do so with clear direction, mitigating further potential issues.
• IR: Personnel

  • When a significant incident is detected, the primary focus is recruiting additional personnel to resolve it. Often, the urgency of these incidents demands a rapid response, requiring a specialised team and subject matter experts (SMEs) to assemble and take action.
  • Without a streamlined process for requesting the necessary personnel, the organisation becomes more at risk for prolonged response times and the escalation of incidents. This deficiency becomes even more apparent outside regular business hours when personnel availability is limited.
• IR: Personnel:

  • If stakeholders are unaware of the incident, they may also be unaware of the reasons for service interruption or the need for system containment. This could result in other business areas taking action and reintroducing risk
  • The IR management team will need to have the means to reach developers and operations stakeholders, ensuring that individuals with the right technical expertise are promptly informed about the issue, even outside their regular working hours.
• IR Retainers

  • It's a valuable proactive strategy for teams to consider the option of retainers in their incident response planning.
  • These retainers are pre-negotiated agreements with external cyber security SMEs and specialised teams who are on standby to assist in the event of a security incident.
  • Having an IR retainer ready to be activated can significantly expedite assembling a response team when a critical incident occurs and allow organisations to tap into a broader pool of experts.
• IR: Communication

  • An essential early step in the IR lifecycle is establishing the team's open communication channels. This step focuses the team's reporting within an agreed-upon place, such as a Slack or Teams channel or a conference call bridge.
  • To further improve communication, the organisation must maintain an up-2-date contact list for all stakeholders. This list should encompass the key individuals involved in the IR process, for example, the CIO, CISO, Head of Information Security, and internal response teams. Or even public communications and government
• IR: Communication

  • Additionally, preparing alternative out-of-band communication methods is essential during incident planning. This is particularly important if the scope of the incident or compromise encompasses the agreed-upon communication method itself, as attackers might be able to eavesdrop and gain awareness of the incident response strategy.
  • It is best to be cautious and assume that threat actors can intercept communications until you have confidence that your regular communication channels are not compromised. E.g Telegram, Signal
• IR: Communication: Situation Reports (SITREPs)

  • Creating Situation Reports (SITREPs) is pivotal in proactively engaging with key stakeholders and establishing a unified source of truth regarding risks. Organisations often overlook the significance of timely progress updates and prioritise technical aspects over communication.
  • An effective SITREP includes a clear summary of the incident for quick understanding. It should highlight key risks and developments that need immediate attention. Additionally, it should summarise and track critical tasks and their status between each team
• IR: Bureaucracy

  • Organisational bureaucracy can also pose challenges for IR teams in various ways. For example, a non-agile decision-making structure, characterised by multiple layers of hierarchy, can often delay when quick and decisive actions are required.
  • Additionally, obtaining necessary approvals and authorisations for performing various remediation or mitigation actions can be time-consuming, further allowing the impact of the incident to escalate.
• IR: Bureaucracy

  • Emphasising IR's strategic importance in protecting organisational assets and company reputation becomes crucial in driving this cultural shift and must be done before an incident occurs during the preparation phase of the IR cycle.
  • On a hands-on level, this will require reevaluating existing protocols, discussing with stakeholders to eliminate redundant approval processes, and empowering IR teams to act decisively in the face of evolving threats.
• Incident Reporting Mechanisms

  • Identifying and responding to incidents heavily relies on the ability of the organisation to quickly and accurately report issues as they arise. However, the lack of a streamlined and efficient reporting mechanism can lead to significant delays or a complete lack of incident detection.
  • A security team can employ techniques to mitigate these challenges, such as implementing automated reporting tools (phishing or other security reporting tools), reporting channels, and conducting regular security awareness training to ensure timely and accurate incident reporting.
• IR: Shortage of Personnel

  • To overcome these challenges, organisations can implement cross-training programs, foster a culture of continuous learning, and establish knowledge-sharing opportunities. Outsourcing certain IR aspects to specialised providers can help supplement in-house capabilities. Further advocations for increased budget allocations by demonstrating the value of a robust incident response team are also crucial for addressing these staffing needs at the top level.
• IR: Inadequate Tooling

  • Organisations can consider exploring open-source tooling as a cost-effective alternative to address budget constraints. Prioritising tool investment based on specific needs or areas according to the organisation's threat model optimises resource utilisation. 
  • Additionally, organisations can consider investing in training to maximise the potential applicability of their existing tools. Alternatively, cloud-based solutions are an option that can offer scalability without a high upfront cost.
• IR: Maximizing Resources

  • Maximising the available IR resources within an organisation begins with risk-based prioritisation. Conducting a comprehensive risk assessment will identify and help prioritise critical assets, allowing teams to allocate resources based on the severity of identified risks.
  • Outsourcing of specific functions can optimise resource allocation. Identifying non-core functions or specialised tasks suitable for outsourcing ensures that internal teams can focus on core security responsibilities. Ensure that outsourced operations align with security and compliance requirements.
• IR

  IR teams can also face data visibility and storage retention challenges. Within the growing nature of digital environments, many variables can contribute to decreased visibility, such as:

  • Asset proliferation and distributed evidence
  • Complexities of data retention
  • Compliance regulations
  • Physical and logical constraints
• IR: Asset Proliferation and Distributed Evidence

  • Utilising a robust asset management system helps maintain an up-to-date inventory of assets across diverse environments. Additionally, using automated discovery tools and centralised asset repositories enables IR teams to quickly identify and track these ever-changing assets.
  • Along with asset discovery, deploying host-based endpoint detection and response (EDR) solutions will enhance the real-time and centralised monitoring, providing visibility into the activities and collecting evidence relevant to security incidents.
• IR: Asset Proliferation and Distributed Evidence

  • Additionally, classifying the necessary evidence is crucial to effectively managing incidents. It is essential to approach evidence collection strategically and in a scalable manner.
  • For instance, obtaining complete disk images from every affected host may not always be practical
  • Instead, the focus should be on gathering only the necessary evidence that helps responders swiftly understand the actions of the threat actor.
• IR: Data Collection

  • Data retention is a delicate balancing act for IR teams, as retaining extensive logs is crucial for post-incident analysis and compliance purposes. However, this process can also introduce storage capacity and cost challenges.
  • Striking the correct balance between retaining enough data to conduct thorough investigations, identifying baselines, and ensuring compliance with legal frameworks like GDPR and HIPAA requires a nuanced approach.
• IR: Data Collection

  • For example, PCI DSS is a security standard for cardholder data collection. Specifically, entities that collect cardholder data must keep an audit trail for at least one year, and at least three months of data must be available for analysis
  • On the other hand, HIPAA is a privacy act that protects an individual's collected medical records and identifiable health information. HIPAA compliance generally requires the retention of data for up to six years. 
• IR: Data Collection

  • Additionally, deploying intelligent data retention policies involves classifying data based on function, criticality, and regulatory compliance. Automated tools for data lifecycle management within SIEM solutions or long-term storage solutions can allow teams to retain critical information while effectively purging non-essential data. 
  • Additionally, many cloud providers offer the ability for data classification and nuanced retention and immutability policies. This kind of approach not only ensures compliance but also optimises storage resources.
• IR: Physical and Logical Constraint

  Physically dispersed infrastructures, remote work scenarios, and the increasing implementation of third-party services all contribute to the difficulty of quickly accessing and analysing critical data during an incident

  • Additionally, the limitations of existing storage solutions, bandwidth constraints, and the sheer volume of data generated in modern environments further strain the capabilities of IR teams, impeding the ability to respond swiftly and effectively.
• IR: Physical and Logical Constraint

  • Organisations can leverage cloud-based storage infrastructure solutions and collaboration tools to overcome physical and logical constraints. Cloud storage enhances scalability and accessibility, allowing IR teams to store and process large volumes of data more efficiently. 
  • Adopting collaborative incident tracking software (like JIRA, ServiceNow, Trello, Asana, etc.) allows seamless communication and coordination among dispersed team members during incident response, overcoming geographical and logistical barriers.
• Anti-Forensics

  Anti-forensics refers to a malicious actor's techniques and strategies to undermine forensic investigations. While digital forensics and IR involve collecting, analysing, and preserving electronic evidence during investigations, anti-forensics techniques erase, hide, or manipulate this evidence, making it difficult for investigators to work with.

  Anti-forensic methods:

  • Data Deletion
  • Encryption
  • Steganography
  • Log Manipulation
  • Memory Forensics Evasion
  • Physical Hardware Manipulation
• Anti-Forensics: Data Deletion

  • Attackers may commonly attempt to erase electronic evidence to impede an investigator's efforts in reconstructing their activities. Various secure file deletion operations can be employed to overwrite existing data with random patterns multiple times, making it difficult or nearly impossible for standard data recovery methods to reconstruct the original information. The manipulation and reformatting of storage devices are basic yet effective measures to interfere with evidence collection.
• Anti-Forensics: Data Deletion

  • Metadata stripping techniques can be used as an additional layer of obfuscation. Metadata is often embedded within files, serving as information about the file itself, such as its creation and modification date, author details, and other contextual attributes.
  • Stripping or removing this metadata from files can further hinder the investigation process by removing valuable contextual information that establishes the origin and history of a file.
• Anti-Forensics: Data Deletion: Protection

  • Regularly backing up critical data to independent storage ensures a restorable copy exists even if data is deleted.
  • Employing endpoint security and file integrity monitoring adds another layer of defence by detecting unauthorised file access and modifications to sensitive data.
• Anti-Forensics: Data Deletion: Protection

  • Additionally, file carving is a data recovery process that attempts to extract deleted information by searching for specific file signatures or patterns within the raw data of a storage device and extracting files based on these patterns.
  • It is a powerful, effective technique even when file system metadata is unavailable or altered. Still, it is not a silver bullet and depends entirely on the accuracy of the file signature detection.
• Anti-Forensics: Encryption

  • While encryption primarily enhances security, threat actors can exploit it as an anti-forensic technique to impede incident response investigations.
  • For example, threat actors may employ disk or file encryption to block access to stored data.
  • This makes it harder for forensic investigators to access and analyse the contents of these encrypted files or disks without the appropriate decryption keys.
• Anti-Forensics: Encryption: Prevention

  • To counteract threat actors using encryption, organisations should first ensure that they maintain regular and secure backups of critical data. Regular, up-to-date backups ensure that systems can be restored in the event of data and file encryption. To mitigate the potential for unauthorised data encryption, it is essential to implement the principle of least privilege.
  • Finally, deploying robust monitoring and detection tools aids in identifying unusual activities on networks and endpoints, even if they involve encrypted data.
• Anti-Forensics: Steganography

  • Steganography is a technique used to hide or embed information within other non-secret data, such as images, audio files, or text, in a way that is not readily apparent. The primary goal of steganography is to conceal secret information rather than secure it through encryption.
  • Unlike encryption, which focuses on keeping information confidential by transforming it into a secure format, steganography aims to make the presence of the information undetectable to unintended recipients.
• Anti-Forensics: Steganography

  In digital steganography, common methods include:

  • Hiding data within the least significant bits of image pixels
  • Altering the spacing between words or characters in a text
  • Embedding information in the frequency components of audio signals

  Regular traffic monitoring, content inspection, and behavioural analysis help identify anomalies and hidden payloads within files. File Integrity Monitoring (FIM) tools can detect unauthorised file changes as an additional defence layer.
• Steganalysis

  • Steganalysis is the process of detecting and uncovering the hidden information within files. It involves analysing statistical properties, frequency distributions, and other patterns within files to identify anomalies indicative of hidden content.
  • Tools like OutGuess aid in the identification and analysis of hidden content within images and different file types.
• Anti-Forensics: Log Manipulation

  • Logs are recorded events or transactions within a system, device, or application. Specifically, these events can be related to application errors, system faults, audited user actions, resource uses, network connections, and more.
  • Log manipulation refers to the unauthorised or malicious alteration of log files within a computer system or network. It can take various forms, such as deleting or modifying log entries, altering timestamps, or simply injecting false information into logs. Attackers manipulate records to conceal their activities
• Anti-Forensics: Log Manipulation: Prevention

  Implementing centralised log management is key to mitigating log manipulation concerns. This also involves:

  • Securing the storage of log files through access controls and encryption
  • Establishing clear log retention policies and implementing integrity checks
  • Performing regular review and analysis of logs, either manually or with automated tools, to identify missing data or timeline anomalies
• Memory Forensics Evasion

  • These techniques can consist of manipulating kernel structures or, for example, through process injection, where malware is inserted into the allocated memory space of a legitimate, trusted process.
  • By injecting into the memory of a trusted process, the malicious code can execute without triggering traditional signature-based detection solutions and evade static analysis. These techniques often make identifying the malware much more challenging for security teams and detection tools.
• Memory Forensics Evasion

  • Unfortunately, mitigating various forms of process injection poses a challenge due to its legitimate integration into the Windows operating system. However, security teams can proactively impede specific types of arbitrary code execution using application control solutions such as AppLocker and Application Control for Windows.
• Memory Forensics Evasion

  • On a broader scale, identification efforts involve looking for anomalies such as the lack of command-line logs or artefacts of network traffic where there shouldn't be.
  • Additionally, focusing on specific high-value processes can identify suspicious behaviour. lsass.exe, for example, is a commonly targeted and sensitive process that warrants meticulous attention during investigations.
• AppLocker

  • AppLocker is a Windows feature that allows administrators to control which applications and scripts users are allowed to run on a system.
• Physical Hardware Manipulation

  • Attackers seeking to impede incident response investigations can manipulate physical hardware by tampering with a system's hardware components.
  • Attackers can disrupt the normal functioning of the system and obfuscate evidence, making it challenging for investigators to reconstruct events accurately.
• Physical Hardware Manipulation

  • One common method involves the insertion of malicious hardware devices, such as rogue USB devices or hardware implants, into the targeted system. These devices can then exfiltrate data, inject malicious code, or create covert command-and-control communication channels.
  • Hardware component substitution is another technique where attackers replace legitimate hardware components with compromised ones. For instance, they might swap a network interface card with a manipulated counterpart designed to redirect or intercept network traffic
• Physical Hardware Manipulation: Prevention

  • The risks associated with physical hardware manipulation should be mitigated by enforcing strict physical security protocols and limiting access to areas housing critical hardware components.
  • Maintaining a comprehensive hardware inventory also enhances the detection of any unauthorised device or system alterations.