Presentation is loading. Please wait.

Presentation is loading. Please wait.

WINDOWS FORENSICS FOR INCIDENT RESPONSE CHRISTIAN KOPACSI CISSP CISM CEH CHFI SECURITY+

Similar presentations


Presentation on theme: "WINDOWS FORENSICS FOR INCIDENT RESPONSE CHRISTIAN KOPACSI CISSP CISM CEH CHFI SECURITY+"— Presentation transcript:

1 WINDOWS FORENSICS FOR INCIDENT RESPONSE CHRISTIAN KOPACSI CISSP CISM CEH CHFI SECURITY+

2 WHAT IS INCIDENT RESPONSE An organized approach to addressing and managing the aftermath of a security breach or attack.

3 STEPS TO SUCCESS

4 PURPOSE OF INCIDENT RESPONSE  Preparation  User Awareness  Detection & Analysis  Did an incident occur  Containment  Prevent further damage  Eradication  Root cause analysis  Recovery  Reimage the affected workstation  Post Incident Activity  Lessons Learned

5 PREPARATION  User Awareness & Training

6 SOCIAL ENGINEERING

7 DETECTION & ANALYSIS  You can’t Respond if you can’t Detect  Logs – Hopefully a SIEM  Workstation \ Server  Firewall  IDS \ IPS  Internet Proxy \ Filter  MSSP \ 3 rd Party  End Users \ Customers  You!

8 CONTAINMENT  Prevent Further Damage  NAC  ACL  Firewall  Switch  Software  Application Whitelisting  AV

9 ERADICATION  Root Cause Analysis  Make Sure Problem Does Not Come Back!

10 RECOVERY  Known Good Configuration  Reimage Device  Restore from Backup

11 POST INCIDENT ACTIVITY  Lessons Learned  What Worked  What Didn’t Work  New Policy \ Procedures  Change to existing Controls  Implement New Controls

12 WINDOWS BASED FORENSIC TOOLKIT

13 TABLEAU WRITE BLOCKER  SATA\IDE

14 DIGITAL CAMERA  Document state of evidence  Inventory items seized

15 CHAIN OF CUSTODY FORM  Log all transfer of evidence

16 EVIDENCE BAGS

17 MISC.

18 ACCESSDATA FTK IMAGER  Physical\Logical Hard Drive Acquisition

19 ACCESSDATA FTK IMAGER  Live Memory Acquisition  Encryption Keys, Passwords, Running Processes

20 IMDISK VIRTUAL DISK DRIVER  Mount evidence files as Read Only Hard Drive

21 REGRIPPER  Registry Analysis  SAM  Security  Software  System  NTUser

22 HELIX  Free Version still available  Best of Both Worlds  Run applications from within Windows  Boot from Linux Live CD

23 MALWAREBYTES ANTI-MALWARE

24 EXIFTOOL - PHOTOS

25 EXIFTOOL – OFFICE DOCUMENTS

26 PROCMON

27 INTERNET EVIDENCE FINDER

28 FORENSIC SOFTWARE SUITE

29 FORENSICS AND THE STATE OF MICHIGAN  PROFESSIONAL INVESTIGATOR LICENSURE ACT  As of May 28, 2008, all computer forensic firms must have a Private Investigators license to practice in Michigan.  Any person engaged in the collection of electronic evidence and/or engaged for the presentation electronic evidence in a Michigan court must have a valid Private Investigators License

30 REFERENCES & THANKS  NIST  NIST   response.html    Chris Pogue – Trustwave SpiderLabs  (Sniper Forensics)

31 NEXT TIME


Download ppt "WINDOWS FORENSICS FOR INCIDENT RESPONSE CHRISTIAN KOPACSI CISSP CISM CEH CHFI SECURITY+"

Similar presentations


Ads by Google