Incident response & computer forensics

Title Page......Page 2
Copyright Page......Page 3
About the Authors......Page 5
 About the Contributors......Page 7
 About the Technical Editor......Page 8
Contents......Page 9
Foreword......Page 18
Acknowledgments......Page 21
Introduction......Page 23
Part I: Preparing for the Inevitable Incident......Page 26
  What Constitutes an Incident?......Page 27
  What Is Incident Response?......Page 29
  Where We Are Now......Page 30
  Case Studies......Page 32
   Case Study #1: Show Me the Money......Page 33
   Case Study #2: Certificate of Authenticity......Page 40
  Concept of the Attack Lifecycle......Page 45
  So What?......Page 47
  Questions......Page 48
  What Is a Computer Security Incident?......Page 49
  Who Is Involved in the IR Process?......Page 51
   Finding IR Talent......Page 54
  The Incident Response Process......Page 57
   Investigation......Page 58
   Remediation......Page 67
   Tracking of Significant Investigative Information......Page 68
  So What?......Page 70
  Questions......Page 71
 Chapter 3: Pre-Incident Preparation......Page 72
   Identifying Risk......Page 73
   Policies That Promote a Successful IR......Page 74
   Thoughts on Global Infrastructure Issues......Page 75
   Educating Users on Host-Based Security......Page 76
   Defining the Mission......Page 77
   Communication Procedures......Page 78
   Deliverables......Page 80
   Resources for the IR Team......Page 81
  Preparing the Infrastructure for Incident Response......Page 90
   Computing Device Configuration......Page 91
   Network Configuration......Page 98
  Questions......Page 109
Part II: Incident Detection and Characterization......Page 111
 Chapter 4: Getting the Investigation Started on the Right Foot......Page 112
  Collecting Initial Facts......Page 113
   Checklists......Page 114
   Building an Attack Timeline......Page 121
  Understanding Investigative Priorities......Page 122
   What Are Elements of Proof?......Page 123
   Setting Expectations with Management......Page 124
  Questions......Page 125
  Defining Leads of Value......Page 126
   Turning Leads into Indicators......Page 128
   The Lifecycle of Indicator Generation......Page 129
   Resolving Internal Leads......Page 145
   Resolving External Leads......Page 146
  So What?......Page 148
  Questions......Page 149
 Chapter 6: Discovering the Scope of the Incident......Page 150
  What Should I Do?......Page 151
   Gathering and Reviewing Preliminary Evidence......Page 152
   Determining a Course of Action......Page 154
  Customer Data Loss Scenario......Page 155
   Customer Data Loss—Scoping Gone Wrong......Page 159
  Automated Clearing House ⠀䄀䌀䠀) Fraud Scenario......Page 161
  So What?......Page 164
  Questions......Page 165
Part III: Data Collection......Page 166
 Chapter 7: Live Data Collection......Page 167
  When to Perform a Live Response......Page 168
  Selecting a Live Response Tool......Page 169
  What to Collect......Page 171
  Collection Best Practices......Page 173
   Prebuilt Toolkits......Page 177
   Do It Yourself......Page 180
   Memory Collection......Page 184
   Live Response Toolkits......Page 189
   Memory Collection......Page 193
  Questions......Page 199
 Chapter 8: Forensic Duplication......Page 200
   Complete Disk Image......Page 202
   Logical Image......Page 205
   Image Integrity......Page 206
   Hardware Write Blockers......Page 208
   Image Creation Tools......Page 211
  Live System Duplication......Page 215
  Duplication of Enterprise Assets......Page 217
  So What?......Page 218
  Questions......Page 219
 Chapter 9: Network Evidence......Page 220
  Types of Network Monitoring......Page 221
   Event-Based Alert Monitoring......Page 222
   Header and Full Packet Logging......Page 224
   Statistical Modeling......Page 225
  Setting Up a Network Monitoring System......Page 228
   Choosing Appropriate Hardware......Page 229
   Installation of a Pre-built Distribution......Page 231
   Deploying the Network Sensor......Page 232
   Evaluating Your Network Monitor......Page 233
  Network Data Analysis......Page 234
   Data Theft Scenario......Page 235
   Webshell Reconnaissance Scenario......Page 243
   Other Network Analysis Tools......Page 251
  Collect Logs Generated from Network Events......Page 252
  Questions......Page 254
 Chapter 10: Enterprise Services......Page 256
   DHCP......Page 257
   DNS......Page 261
   LANDesk Software Management Suite......Page 267
   Symantec Altiris Client Management Suite......Page 271
  Antivirus Software......Page 273
   Symantec Endpoint Protection......Page 274
   McAfee VirusScan......Page 277
   Trend Micro OfficeScan......Page 281
  Web Servers......Page 283
   Web Server Background......Page 284
   Apache HTTP Server......Page 286
   Microsoft Internet Information Services ⠀䤀䤀匀)......Page 288
  Database Servers......Page 291
   Microsoft SQL......Page 293
   MySQL......Page 294
   Oracle......Page 296
  So What?......Page 297
  Questions......Page 298
Part IV: Data Analysis......Page 299
 Chapter 11: Analysis Methodology......Page 300
  Define Objectives......Page 301
   Where Is Data Stored?......Page 303
   What’s Available?......Page 305
  Access Your Data......Page 306
   Outline an Approach......Page 310
   Select Methods......Page 312
  Evaluate Results......Page 317
  Questions......Page 318
 Chapter 12: Investigating Windows Systems......Page 319
  NTFS and File System Analysis......Page 320
   The Master File Table......Page 321
   INDX Attributes......Page 332
   Change Logs......Page 334
   Volume Shadow Copies......Page 336
   File System Redirector......Page 338
   The Evidence......Page 340
   Analysis......Page 342
  Event Logs......Page 345
   The Evidence......Page 346
   Analysis......Page 347
   Creating Tasks with the “at” Command......Page 359
   Creating Tasks with the schtasks Command......Page 361
   The Evidence......Page 362
   Analysis......Page 363
   The Evidence......Page 369
   Analysis......Page 376
   Registry Analysis Tools......Page 407
   LNK Files......Page 410
   Jump Lists......Page 412
   The Recycle Bin......Page 414
  Memory Forensics......Page 417
   The Evidence......Page 418
   Memory Analysis......Page 422
  Alternative Persistence Mechanisms......Page 433
   Startup Folders......Page 434
   System Binary Modification......Page 435
   DLL Load-Order Hijacking......Page 436
  Review: Answering Common Investigative Questions......Page 439
  So What?......Page 443
  Questions......Page 444
 Chapter 13: Investigating Mac OS X Systems......Page 445
   Volume Layout......Page 446
   File System Services......Page 453
   File System Layout......Page 457
   User and Service Configuration......Page 464
   Trash and Deleted Files......Page 468
   System Auditing, Databases, and Logging......Page 469
   Scheduled Tasks and Services......Page 481
   Application Installers......Page 485
  A Review: Answering Common Investigative Questions......Page 486
  So What?......Page 488
  Questions......Page 489
 Chapter 14: Investigating Applications......Page 490
   Windows......Page 491
   OS X......Page 492
   Linux......Page 493
  General Investigation Methods......Page 494
  Web Browsers......Page 499
   Internet Explorer......Page 501
   Google Chrome......Page 508
   Mozilla Firefox......Page 513
  E-Mail Clients......Page 518
   Web E-Mail......Page 520
   Microsoft Outlook for Windows......Page 521
   Apple Mail......Page 526
   Microsoft Outlook for Mac......Page 527
   Methodology......Page 529
   Instant Message......Page 530
  So What?......Page 539
  Questions......Page 540
 Chapter 15: Malware Triage......Page 541
   Safety......Page 542
   Documentation......Page 544
   Distribution......Page 545
   Accessing Malicious Sites......Page 546
  Triage Environment......Page 547
  Static Analysis......Page 549
   What Is That File?......Page 550
   Portable Executable Files......Page 563
  Dynamic Analysis......Page 568
   Automated Dynamic Analysis: Sandboxes......Page 569
   Manual Dynamic Analysis......Page 570
  So What?......Page 577
  Questions......Page 578
  Why Write Reports?......Page 579
  Reporting Standards......Page 580
   Report Style and Formatting......Page 581
   Report Content and Organization......Page 586
  So What?......Page 589
  Questions......Page 590
Part V: Remediation......Page 591
  Basic Concepts......Page 592
   When to Create the Remediation Team......Page 600
   Assigning a Remediation Owner......Page 601
   Members of the Remediation Team......Page 604
  Determine the Timing of the Remediation......Page 605
  Develop and Implement Remediation Posturing Actions......Page 607
   Implications of Alerting the Attacker......Page 609
  Develop and Implement Incident Containment Actions......Page 611
  Develop the Eradication Action Plan......Page 614
  Determine Eradication Event Timing and Execute Eradication Plan......Page 620
  Develop Strategic Recommendations......Page 625
  Document the Lessons Learned......Page 626
  Putting It All Together......Page 627
  Common Mistakes That Lead to Remediation Failure......Page 634
  Questions......Page 635
 Chapter 18: Remediation Case Study......Page 637
   Select the Team......Page 638
   Contain the Incident......Page 640
   Posture the Environment......Page 645
   Eradicate the Attacker......Page 649
   Set the Strategic Direction......Page 654
  Questions......Page 658
Index......Page 660