>> Part of not panicking and not trashing
the crime scene is to actually
maintain the integrity of the scene.
If you're that first responder on
the scene and something happened,
and you want to initially start poking around,
it's actually very important to refrain from trying
to essentially start handling
and remediating an incident,
before you actually know what's going on.
Unless otherwise directed by the
>> Incident Response Team,
>> first responders and individuals who
happen to be the initial portion on the scene,
should refrain from doing the following,
logging in and poking around the system.
If the machine is actually in an off-state,
it's very important to leave
that machine in an off-state.
If the system actually has a virus on it
or it's trying to connect to
a network to do something malicious,
logging on and poking around,
one can put that machine
back in contact with the network.
Two, you might actually start destroying some of
the evidence that's on that machine,
or at least contaminating
it with additional evidence that
investigators will have to go back and try and sift
through to figure out what
the actions of the first responder were,
vice the actions of
the person who had previously logged into that
>> machine and or the malware incidence that occurred.
>> Essentially it's important to let other people know
>> that they should refrain from doing the same thing.
>> If you happen to be that first responder
and you call someone for help and they want to come
in and maybe start poking around in the machine, it's
>> essential that they refrain from doing that as well.
>> Another thing is that if you have a limited amount of
IT experience or even a vast amount of IT experience,
you should refrain from running
attack probes to determine if
your site is vulnerable to some particular attack.
Essentially leave that to the Incident Response Team.
Once the event or incident has been escalated to them,
they will know how to essentially go back and
>> respond to that incident in that logical fashion
>> that we've talked to with our react principle.
The other thing we want to avoid is halting
the machine being unapproved or abnormal principle.
Unless the machine is causing
some grievous damage to
your network or to the machine itself,
stopping that process and
that unapproved manner that abnormal procedure can
actually limit the availability of
the information that investigators are able to collect.
The next thing we want to avoid
>> is engaging the attacker.
>> If we're actually,
>> essentially being sent malicious e-mails
>> or if we're able to communicate
somehow with someone who's hacking
our system by speaking to that individual,
or we may encourage them to conduct
additional attacks and we're
also tipping them off that we're on to them,
which they may stop doing the attacks or try
>> and destroy any evidence they've had
>> themselves perpetrating those attacks.
Then probing the involved network.
If there's already some type of
attack going on with your network,
if somebody might be probing your network
or trying to hack it externally,
starting to probe that network is going to add
additional probes or information
that the Incident Response Team
is going to have to sift through.
Now they're going to have to essentially figure
out what was your external traffic,
which is just going to compliment,
take the matters and make
handling that incident prolonged.
Like we talked about earlier,
part of maintaining scene integrity
is also maintaining scene security.
Operational security is essentially a collection of
processes by which an organization
denies to potential adversaries,
information about its structure,
intentions, and activities.
As part of operational security
as it relates to the incident response,
it's important to consider what will
your actions indicate to
the adversary that something is up?
Often times an adversary may want to only
attack a particular target if they feel
it's adorable and it's not likely that that target
will respond or that the adversarial want to
do something and get out of the system or stop
the attack before the adversary
or before their target established by them.
In keeping with that,
what actions the Incident Response Team
takes may essentially tip off that adversary.
Will a flurry of e-mails or
other in-band communications tip
off that actor that something has occurred?
If they're already within inside that network
that there already able to see certain e-mails,
essentially e-mailing back and
forth between each other and the company,
might tip off that attacker that something is going on.
Also, essentially,
individuals talking with each other within the company.
You may not know how this actor got in the system,
but if there is essentially a Presley
or individuals talk this
inside or outside of work channels,
it could create essentially a situation
where the threat actor or adversaries are
able to discover that the organization is onto them and
they want to cease their activity or
destroy evidence of their activity.
Then another thing that could happen is
changing your established daily activities.
If the adversary has done
homework on you during that reconnaissance phase,
and essentially he's established
a pattern or a hack for that company,
a change in the daily established routines of
that organization could indicate to
that adversary that something is happening.
For instance, a very good indicator that something
may be up is that a change in physical security.
If the adversary does
reconnaissance on a particular target and he
notices that there's very
light physical security around the building.
But then after he's done
his attack or something has occurred
and then all of a sudden you see
gate guards pull up and there's perimeter lighting,
now that would indicate to the adversary that
something is different than it used to be.
Then another aspect of maintaining security,
is maintaining a strict need to know.
You don't want everyone within
your organization or within your company,
to know that a particular incident
has occurred until after it's
already been remediated and
you're starting to do that education phase.
The attacker, essentially maybe
among you or monitoring you.
We'll talk about attackers
being among the organization little bit
later in our discussion
about malicious insiders or cyber insider threats.
Essentially maintaining good
operational security helps that
Incident Response Team to
investigate and remediate that incident,
without providing too much information
to that adversary or that threat actor.