Comprehensive Incident Handling and Digital Forensics Study Guide
Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) Strategies
Slowloris Attack: A targeted application-layer (HTTP) assault that slowly opens many HTTP sessions and keeps them open. This strategy drains server resources and exhausts its ability to manage requests without requiring high bandwidth from the attacker.
Permanent Denial-of-Service (PDoS): Also known as "phlash." This type of attack causes irreversible physical damage to hardware, necessitating full equipment replacement. It differs from other DoS types that primarily affect service availability.
High Orbit Ion Cannon (HOIC): A utility used to bombard multiple websites/URLs (up to 256) with simultaneous, high-volume HTTP request floods.
Smurf Attack: A method that disrupts a target by overwhelming the system using ICMP echo requests (ping) sent to a broadcast address with a spoofed source IP of the victim.
Fraggle Attack: A variation of the Smurf attack that uses UDP floods rather than ICMP.
MAC Flooding: A technique that manipulates a switch by overwhelming its CAM table. This forces the switch into a "fail-open" mode, where it acts like a hub and broadcasts all traffic to every port, enabling packet sniffing.
Botnet-Driven DDoS: Characterized by multiple compromised systems (such as all company servers simultaneously) flooding a specific domain. This indicates a coordinated attack via a network of infected devices.
Mitigation Tools:
Incapsula: A cloud-based security solution designed specifically to mitigate DDoS attacks.
Inline IPS Devices: Devices placed inline that can actively block network-based attacks in real-time as they pass through the system.
Incident Response Lifecycle and Phase Definitions
Detection and Analysis (Identification Phase): The phase where responders confirm the presence of an actual incident through investigation and assessment (e.g., verifying screenshots, checking logs, and assessing network conditions).
Incident Triage: The process of initial review to determine if an alert represents a real security incident or a false alarm. It involves analyzing, confirming, categorizing, and prioritizing identified threats to ensure efficient resource allocation.
Containment: The phase focused on limiting the spread or damage of a security incident. Key activities include taking steps to reduce the effect of the breach and performing full system backups to protect evidence and support recovery.
Eradication: The phase dedicated to removing the root cause of the incident and closing vulnerabilities (e.g., patching systems, working with vendors) to prevent repetition of the attack.
Recovery: The phase where systems are restored to normal operation and monitored for any lingering signs of compromise.
Forensic Readiness: An organization’s capability to quickly and cost-effectively utilize digital evidence during an investigation.
Organizational Roles in Incident Response
Incident Coordinator / Incident Manager: Responsible for overseeing both strategic decisions and the technical/tactical response to cybersecurity incidents.
Internal Auditor: Responsible for assessing and reporting security gaps and vulnerabilities to higher-ups. This role does not implement direct technical changes like firewall rules or disabling ports.
Point of Contact (POC): Serves as a liaison during response efforts, handles permissions/authorizations, and is the primary person to notify for further action during a breach.
NIST Cloud Computing Roles:
Consumer: The buyer or user of cloud services.
Provider: The entity offering the service (e.g., AWS).
Carrier: The intermediary/ISP providing connectivity.
Auditor: The party responsible for compliance and security assessments.
Broker: A third-party Managed Service Provider (MSP) that manages cloud usage.
Digital Forensics and Evidence Handling
Order of Volatility: Investigators must prioritize collection based on how quickly data disappears. The standard hierarchy includes:
High Volatility: CPU Cache (first), RAM/Process Memory.
Medium Volatility: Page file/Swap space.
Lower Volatility: Physical devices (Hard drives, USBs), backups, and remote logs.
Bit-level Analysis: A forensic method that allows experts to retrieve deleted data or read unallocated space without altering the existing disk contents.
Data Integrity and Hashing: Investigators apply hashing algorithms (using a Hash Calculator) to ensure digital evidence remains untampered. In forensics, .
Evidence Labeling: Physical packaging for digital evidence must document the following:
Time of collection.
Item ID (Exhibit number).
Identity of the handler/person responsible for collection.
Static vs. Dynamic Analysis:
Static Analysis: Reviewing data at rest (e.g., analyzing a drive image without running it).
Dynamic Analysis: Involves legal or technical analysis during the execution of code or system processes.
Evidence Qualities:
Authenticity: Confirming the source and original state of evidence.
Believability: Ensuring findings are clear, credible, and persuasive for non-technical audiences, such as a jury.
Forensic Tools:
Autopsy: A full-featured tool for examining file systems, recovering deleted items, and analyzing browser artifacts.
FTK Imager/ProDiscover: Tools used for forensic imaging and collection.
Malware Types and Threat Actor Tactics
Trojan: Software that appears beneficial or legitimate but covertly installs malicious capabilities or grants remote access once activated.
Virus: Malware that attaches itself to host files, corrupting or deleting data, and spreads only when the host file is executed.
Worm: Self-replicating malware that spreads across networks without human intervention.
Steganography: The process of concealing data within images, audio, or video files to avoid detection.
Obfuscation: The use of vague, complex, or misleading code to hide the meaning of malicious scripts from security analysis.
Macro Abuse: Embedding malicious macros in Microsoft Office documents to trigger unauthorized downloads or code execution when the user opens the file.
Exploitation of Unvalidated Redirects: Using a trusted domain name to redirect users to a malicious site, abusing the trust associated with the original URL.
Rogue Access Point: An unauthorized wireless device placed inside a corporate firewall to allow external access while bypassing network defenses.
Social Engineering and Behavioral Threats
Phishing Traits: Emails often use subject lines that create a sense of urgency or fear to provoke impulsive actions.
Whaling: A specific form of phishing that targets high-ranking senior executives to exploit their privileged access.
Pharming: Redirecting users to fraudulent websites via DNS cache poisoning, even if the user types a valid URL.
Insider Threat: Employees or internal members who misuse legitimate access for inappropriate usage or espionage. User Behavior Analytics (UBA) tools are used to flag anomalies in how employees interact with systems.
Espionage: Stolen confidential data given to a competitor to provide a competitive edge.
Cloud Security and Infrastructure
Side Channel Attack: An attack where a malicious user installs a virtual machine on the same host as a target VM and exploits shared processor cache or indirect signals to steal data.
Shared Responsibility in SaaS: In a Software-as-a-Service model, the SaaS provider is responsible for removing malware from customer databases and securing application-layer components.
Cloud Service Abuse: Misusing cloud resources for unauthorized activities such as password cracking or launching DDoS attacks.
Cloud Specific Challenges: Security must account for data mobility and regulatory compliance across different jurisdictions.
Network Utilities and Command Line Tools
Netstat Commands:
netstat -an: Displays all active network connections and listening ports in numeric format; helpful for spotting flood behavior.netstat -ab: Displays active connections along with the specific executables responsible for them.
Traceroute (tracert on Windows): A utility used to trace the network path, track packet paths, and identify delays/latency across network nodes.
MxToolbox: An online tool used for tracing email sources and examining message headers to detect spoofing.
Wireshark Filters:
icmp.type == 8: Filters for ICMP Echo Requests (Ping).icmp.type == 0: Filters for ICMP Echo Replies.Ping Sweep Detection: Using a filter like
icmp.type == 8 or icmp.type == 0to see discovery probes across a range of IPs.
MBSA (Microsoft Baseline Security Analyzer): A tool used to scan Windows systems for missing security updates and configuration issues.
Sendmail Logs: On Linux systems, transaction logs for Sendmail are typically stored in
/var/log/maillog.
Security Policy Frameworks
Promiscuous Policy: Zero restrictions; "Allow all" by default. Very low security, high exposure.
Permissive Policy: Allows most activities by default; blocks only known threats. High exposure.
Prudent Policy: Denies all by default; allows only known safe actions. Offers strong security for enterprises.
Paranoic Policy: Extremely restrictive; "Deny all." Used for high-security environments like military or classified systems.
ISO/IEC 27002: A standard providing guidance on selecting and implementing security controls for an Information Security Management System (ISMS).
Incident Categories (US-CERT Style)
CAT 1 (Unauthorized Access): Malware used for credential theft or creating backdoors.
CAT 2 (User Compromise): Situations where a user account is compromised via phishing or malware.
CAT 3 (Malicious Code): Direct malware infections like viruses or worms spreading across the network.
CAT 4 (Denial of Service): Malware used to disrupt services via botnets or flooding.
Risk Management and Lab Setup
Risk Assessment Phases:
Likelihood Analysis: Evaluating the probability that a threat actor will exploit a specific vulnerability.
Risk Assessment (General): The structured approach to identifying risks, evaluating impacts, and recommending management strategies.
Forensic Lab Implementation Order:
Create a budget and plan resource needs.
Identify and prepare the physical location/structural layout.
Design work area layout and functionality.
Implement physical security controls.
Evaluate human resource requirements.
Apply for necessary forensic lab licenses.