Lesson 12 - CertMaster
Lesson Introduction
Incident response involves investigating alerts from monitoring systems and user-reported issues.
Guided by policies, procedures, and technical controls.
A critical security function in cybersecurity.
Key components to be covered:
Phases of incident handling.
Appropriate data source utilisation.
Security alerting and monitoring tools.
Topic 12A: Incident Response
Exam Objectives Covered
Summarize incident response and digital forensics procedures.
Utilize appropriate data sources for investigations.
Explain security alerting and monitoring concepts and tools.
Effective Incident Response Activities
Governed by formal policies setting roles for incident response teams.
Importance of following established procedures.
A cybersecurity incident can compromise confidentiality, integrity, or availability.
The 7-step CompTIA incident response lifecycle:
Preparation: Involves hardening systems and creating incident response resources.
Detection: Identifies indicators of threat activities, which could be automated or manual.
Analysis: Determines the occurrence of an incident and triages severity.
Containment: Limits the scope of the incident and secures data.
Eradication: Removes causes and restores secure states.
Recovery: Reintegrates systems into business processes with close monitoring post-incident.
Lessons Learned: Analyzes incidents for process improvements and documentation.
Complexity of Incident Response
Coordination and authorization may be required from different departments.
Major incidents require disaster recovery processes, but can be triggered by cybersecurity incidents.
Preparation Process
Updates and establishes policies and procedures for security breaches.
Cybersecurity infrastructure involves tools for incident detection and digital forensics (e.g., SIEM, SOAR).
Cyber Incident Response Team (CIRT)
Composed of members with varied security competencies.
Often housed in a Security Operations Center (SOC).
Led by senior executives for decision-making authority.
Roles involve visibility through incident detection tools, digital forensics, and case management.
Communication Plan
Policies should include clear protocols for incident reporting and communication with stakeholders.
Prevent unauthorized information release about incidents to maintain the integrity of incident response.
Stakeholder Management
Manage information regarding incidents cautiously to avoid unnecessary publicity or breaches of trust.
Various departments including legal, HR, and public relations should be involved during incidents.
Incident Response Plan (IRP)
Formal document listing procedures, contacts, and resources for various incident categories.
Importance of providing confidential reporting options for employees.
Analysis and Detection
Analysis after Detection
The analysis of indicators to confirm incidents and understand priorities.
Classification of incidents helps allocate resources appropriately.
Factors Affecting Impact Determination
Category of incident, data integrity, downtime, and economic effects classified under:
Incident Categories: Establish a shared understanding among personnel.
Impact Severity: Determined by data value at risk and disruption to business operations.
Playbooks and Response Scenarios
CIRT develops profiles for typical incidents guiding prioritization.
Playbooks serve as SOPs for handling specific scenarios.
Techniques for containment include isolation-based and segmentation-based methods.
Eradication and Recovery
After containment, remove intrusion tools and unauthorized changes.
Recovery includes ensuring hosts operate securely post-incident.
Revise baseline configuration to prevent reoccurrence of attacks.
Lessons Learned
Conduct reviews after incidents to understand root causes and improvements.
Utilize "Five Whys" model for root cause analysis.
Digital Forensics and Data Sources
Digital Forensics Basics
Involves examining evidence from systems and networks to find information.
Evidence continuity and documentation are crucial for legal validity.
Due Process and Legal Considerations
Digital forensic investigations must preserve the integrity of evidence.
Importance of compliance with laws affecting evidence collection.
Data Acquisition Techniques
Types of Data Acquisition
System Memory Acquisition: Captures volatile data from RAM.
Disk Image Acquisition: Acquires data from non-volatile storage devices.
Preservation and Integrity
Evidence must follow a documented chain of custody to ensure integrity.
Utilize tools like write blockers during evidence collection to maintain data integrity.
Reporting and E-Discovery
Forensic reporting must adhere to ethical analysis standards.
E-discovery tools facilitate the process of sifting through collected evidence.
Alerting and Monitoring Tools
SIEM Concepts
SIEM tools collect and analyze logs from diverse sources for security data and alerts.
Collect (via agent-based or agentless methods) and normalize data for reporting analysis.
Log Aggregation and Alerting Activities
Analyze and correlate data to trigger alerts for potential incidents.
Implement correlation rules to manage investigation processes based on data sources.
Reporting Frameworks
Tailor reports to meet the needs of different stakeholders within organizations.
Monitor infrastructure metrics for the health of security operations.
Conclusion
Prioritize incident response preparedness and monitoring efficiency.
Develop guidelines for structured incident response and strong communication strategies.
Criteria for using data sources in investigations should be well-established.