containment, eradication, recovery, and post incident actions

containment steps

1. ensure the safety and security of all personnel

2. prevent an ongoing intrusion or data breach

3. identify if the intrusion is the primary or secondary attack

4. avoid alerting the attacker that the attack has been discovered

5. preserve forensic evidence of the intrusion and attack

isolation

a mitigation strategy that involves removing an affected component from a larger environment

segmentation

mitigation strategy that achieves the isolation of a host or group of hosts using network technologies and architecture

• uses VLANs, routing/subnets, and firewall ACLs to prevent communication outside the protected segment

sanitization

group of procedures that an organization uses to govern the disposal of obsolete information and equipment

cryptographic erase(CE)

a method of sanitizing a self encrypting drive by erasing the media encryption key

-(tends to be for solid state drives)

zero-fill

a method of sanitizing a hard drive by overwriting all bits on the drive with zeros

• not a reliable method to use with SSDs and hybrid drives

secure erase(SE)

method of sanitizing a solid-state device using manufacturer provided software

secure disposal

a method of santizing that utilizes physical destruction of the media by mechanical shredding, incineration, or degaussing

eradication methods for different drive types

self-encrypting drive- cryptographic erase(CE)

magnetic drive- zero-fill

solid-state drive- secure erase(SE)

reconstruction

a method of restoring a system that has been sanitized using scripted installation routines and templates

reimaging

a method of restoring a system that has been sanitized using an image-based backup

reconstitution

a method of restoring a system that cannot be sanitized using manual removal, reinstallation, and monitoring processes. 7 steps:

1. analyze processes and network activity for signs of malware

2. terminate suspicious processes and securely delete them from the system

3. identify and disable autostart locations to prevent processes from executing

4. replace contaminated processes with clean versions from trusted media

5. reboot the system and analyze for signs of continued malware infection

6. for continued malware infection, analyze firmware and USB devices for infection

7. if tests are negative, reintroduce the system to the production environment

3 simple mottos for system hardening

1. uninstall anything you aren’t using

2. if you need it, patch it frequently

3. always restrict users to the least privilege

post incident activities

• report writing

• incident summary report

• evidence retention

evidence retention

the preservation of evidence based upon the required time period defined by regulations if there is a legal or regulatory impact caused by an incident

lessons learned-6 structured questions

1. who was the adversary?

2. why was the incident conducted?

3. when did the incident occur?

4. where did the incident occur?

5. how did the incident occur?

6. what controls could have mitigated it?

root cause analysis

systematic process to identify the initial source of the incident and how to prevent it from occuring again

1. define and scope the incident

2. determine the causal relationships

3. identify an effective solution

4. implement and track the solution

you are conducting an incident response and have already eradicated the malware from a victimized system. which of the following actions should you perform as part of the recovery phase?

sanitization

reimaging

setting permissions

secure disposal

setting permissions. following an incident, all types of permissions should be reviewed and reinforced. this especially affects file and firewall ACLs and system privileges assigned to administrative user or group accounts. this is performed during the recovery phase. during the eradication phase, you would conduct sanitization, secure disposal, and reimaging.