>> Hello Cybrarians, and welcome to
another exciting course presented by Cybrary.
Today we're going to
continue with our incident response and
advanced forensics course and we'll
be discussing incident handling.
As part of incident handling,
it's unnecessary to understand
the incident response life cycle.
There are many different ways of looking at this.
Some life-cycles,
you'll see have five stages, some have six.
This particular sought slide you see has seven,
and they've divided that up into
security operations and network operations.
This incident lifecycle shows
the Identification of the incident analysis
to determine the scope,
magnitude, and artifacts that
may be present within that incident.
Going over to gathering that evidence to help
understand more of the incident and
then moving on to the containment communication,
eradication, and refinement of
policy to hopefully prevent future incidents.
With that being said,
it's also important to understand
where the incident response process begins.
This slide here, a very colorful and very busy,
but this actually coincides with
the cyber kill chain that's presented by Lockheed Martin.
You might often hear that
within the circles within the IT community.
The upper portion of this slide is
the actual cyber kill chain
that Lockheed Martin has created.
Goes with reconnaissance phase,
the weaponization of whatever type of malware
that is being delivered.
In that third stage,
the exploitation of a computer system,
and installation on that computer that leads
to eventual commanded control
and then the actions of the objective.
Then down below you see the step process
that incident responders should take in order
to stop those above processes.
It's going to be the detection of that incident,
denying the adversary the ability
to conduct that incident,
disrupting whatever operations that they
have, degrading ongoing operations,
possibly deceiving the adversary threes plenty nets,
and then actually destroying or
mitigating that type of the incident that they've cost.
Then in the middle section you can see it's broken up
into proactive detection and mitigation,
and then containment and incident response.
That proactive detection and mitigation
goes into that pre-compromise and just then to
that compromise stage and
then contain metadata incident response
take over from the compromised
to the host compromised portion.
Looking at this slide,
you can see that the earlier that
the incident or event is detected,
the easier that it's going to be
to contain or eradicate that of debt.
Initially, when you're in
that reconnaissance or weaponization stage,
essentially proactive detection and mitigation might
actually be able to tell them that that event,
becoming an actual incident that
warrants a response from your incident response team.
Once you get to that compromise and
post-compromise stage and it becomes
an actual full-blown incident that's going to
require that incident response team to come in.
We actually look at this incident life cycle,
we can see going back to what the incident response team,
but actually have to do when it
becomes a full-blown incident.
But obviously, an ounce of
prevention is worth a pound of cure,
so the earlier that you could detect this
in that reconnaissance stage before it
actually gets him at that exploitation stage,
the better off you are.
What we're going to focus mainly in this talk today in
the post-compromise and then
after the exploitation of a system.
Again, as we talked about in
the policy portion of
the incident response or if you
haven't seen that video yet.
The first thing that the incident response team is going
to have to do is to prioritize the incident.
In prioritizing that incident,
that's pretty important because first and foremost,
not all incidents carry the same priority or same way.
As we talked about in
the previous section regarding policy.
Obviously, a denial of service attack is
probably going to carry
a lot more weight than a simple spam email.
The policy should dictate
the sphericity of density and what
steps this team should
take in order to prevent that incident.
It's just laying out a central playbook
for that incident response team,
and obviously, not all incidents
warned that same response as we talked about.
The responder should follow the policy in
common sense when responding to incidents.
Obviously, going back to policy,
policy should dictate your response,
keeps you legal,
or keeps you within compliance of your organization.
Then using good old common sense and responding to
these incidents is also paramount.
Again, who is involved in cyber incident response?
We also touched on this in
the policy portion depending on your organization,
the personnel that are going to be
involved in the response may or may not be different.
But obviously, at the center of this is going to
be your computer incident response team or cert team.
Then around that,
you may have individuals from
your operations of your organization.
You may have legal involved,
you may have human resources,
public relations, you may have
the system owner involved as well.
You have compliance issues or compliance officers,
they may be involved.
Then obviously, that senior management
that's very important because they're going
to have to be kept abreast of
the situation depending on
what type of actions may or may not need to be taken.
Senior management probably have to come in and at
least approve and take some of those actions.
Looking at your team composition,
this slide lays out the roles and
responsibilities of that computer incident response team.
The director of the team,
he's the one that's going to
essentially be from senior management or
have a link to senior management who
has the authority to carry out
those incident response activities.
They'll often be that person they may or may not do
the actual incident response work that will be
that liaison to management and be
able to help direct the overall incident response task.
Then below that, you're going to have
the lead investigator and the lead investigator
is in charge of the operations
aspect of the incident response activities.
They're going to ensure that
the incident response is
executed in that right order and the
processes and followed that
just overseeing that overall response.
Then you'll also have
essentially forensics technicians and
they're going to carry
out your basic incident response task
at the direction of that lead investigators.
They're going to go out, they're going to
look for the artifacts,
they're going to try and figure out what type of
malware may have infected that system,
and to the extent of the problem.
You'll also have your incident response handler,
and this is usually the first one is
going to be on the scene and they must react.
Depending on the type of organization you have,
it may not necessarily be that user,
but if you have a large distributed organization,
maybe that first level IT person
that a user can go to and say,
Hey, I've noticed this problem with the computer.
Or maybe the IT manager himself
that he notices something on
his logs IDS that
notifies him that there's essentially a problem.
Then you'll have an incident handler,
that person is essentially going to be maybe that
individual that the response handler is going to notify.
Or it may actually, the response handler
may turn into that incident handler.
What they're going to do is they're going to
ensure that the evidence is protected,
and they may also gather that evidence at the scene.
It could involve maybe
doing involve told memory forensics,
or at least ensuring that there's
no destructive activity taking place on that system.
Then lastly, we're going to have a legal advisors.
They're going to provide
guidance consistent with local, state,
federal laws or policy of
your organization because we
always want to keep it legal.