Chapter 4: Operations and Incident Response

Chapter 4

Objective 4.1

Network Reconnaissance and Discovery

• pathping → Combines ping & tracert command
  • Admins use it to locate potential problems between two systems
• hping → This command is similar to ping command but it can send the ping using TCP, UDP & ICMP packets
  • Useful to identify if firewall is blocking ICMP traffic
• theHarvester → Passive recon CLI tool → Uses OSINT methods to gather data such as emails, employee names, host IPs, & URLs
  • It uses popular search engine for queries & give you a report
• sn1per → Automated scanner used for vulnerability assessment & to gather info on targets during penetration test
• scanless → Python based CLI tool used to scan ports
• dnsenum → Enumerate DNS records for domains
  • It can perform many Domain Name System (DNS)-related functions, including querying A records, nameservers, and MX records, as well as performing zone transfers, Google searches for hosts and subdomains, and net range reverse lookups.
  • It can work in automated fashion
• Cuckoo → Open Source automated software analysis system / Sandbox
  • Primary purpose → Analyze suspicious files

Forensics

• dd → Disk Imaging Tool (Open Source Tool)
• memdump → Can dump any addressable memory space to the terminal or redirect the output to the dump file
• WinHex → Windows-based hexadecimal editor used for evidence gathering, data analysis, editing, recovering of data & data removal
  • It can work directly with the memory
• FTK imager → A part of Forensic Toolkit (FTK) sold by AccessData (Proprietary Tool)
  • FTK Imager is a free tool that can image both systems and memory
  • It can capture an image of a disk as a single file or multiple files & save the image in various formats
• Autopsy → GUI Digital Forensic Platform → Forensic Utilities

Objective 4.2

Incident Response Plan

• This plan provides details about incident response policy
• It provides organizations with a formal, coordinated plan than personnel can use when responding to the event
• Elements:
  • Definitions of Incident Types → Helps to identify difference between an event & an actual incident
  • Incident Response Team → This team is composed of employees with expertise in different areas
    • Also referred as → A computer incident response team (CIRT), Security Incident Response Team, Computer Emergency Response Team (CERT)
  • Roles & Responsibilities → Many incident plan identify specific roles for incident response team along with their responsibilities

Communication

• Communication is a part of incident response plan & it provides directions on how to communicate issues related to an incident
• Communication Plan includes:
  • First Responders → Initial responders should know when to inform incident response entities & who to contact
  • Internal Communication → Incident Response Team should know when to inform senior personnel of an incident
  • Reporting Requirements → Laws requires reporting requirements
  • External Communication → Media
  • Law Enforcement → Provides teams with Digital Forensics tools & knowledge
  • Customer Communication → Laws indicate that when an organization must inform their customers regarding data breach

Incident Response Process

• Preparation → This phase occurs before an incident & provides guidance to personnels on how to respond to an incident
• Identification → Verify it is a actual incident or not
• Containment → After identifying an incident, security personnel attempt to isolate or contain it
  • This protects critical systems while maintaining business operations
  • The goal of isolation is to prevent the problem from spreading to other areas in network
• Eradication → After containing the incident, it’s necessary to remove components from the attack
  • Includes deleting or disabling the infected accounts
• Recovery → During the recovery process, admins return all affected systems to normal operation & verify they are operating normally
• Lessons Learned → After personnel handle an incident, security personnel perform the lessons learned review
  • This incident may provide some valuable lessons & organizations might modify procedures or add additional controls to prevent reoccurrence of the incident

Exercises

• Tabletop Exercise → Also known as Desktop Exercise → Discussion Based Exercise
  • A coordinator gathers participants in a room & leads them through one or more hypothetical scenarios such as cyber-attack or natural disaster
  • The coordinator introduces each stage of the scenario & the participants identify how they would respond based on organization’s plan
  • This exercise validates the plan & sometimes reveals flaws
• Walkthroughs → Workshops or orientation seminars that train team members about their roles & responsibilities
  • Helps the personnel to plan tabletop exercise to develop a formal tabletop test plan
• Simulations → Functional exercises that allow personnel to test the plan in a simulated operational environment → Hands-On Exercises

Attack Frameworks

• MITRE ATT&CK → Adversarial Tactics, Techniques And Common Knowledge
  • It is a knowledge base of tactics, techniques used in real-world attacks
• The Diamond Model of Intrusion Analysis → Focus on understanding the attacker by analyzing four key components of every intrusion event:
  • Adversary → Can be identified by email addresses, handles used in online forums
  • Capabilities → Refers to malware, exploits & other hacker tools used in intrusion
  • Infrastructure → Refers to internet domain names & IP addresses used by adversary
  • Victim → Victims can be identified by their names, emails or network identifiers
• Cyber Kill Chain → Includes seven elements of tracking attack from recon to performing actions to achieve attacker’s objectives
  • Lockheed Martin cyber kill chain → Implicitly assumes a unidirectional workflow
    • It fails to consider that an adversary may retreat during an attack
  • Workflow:
    1. Reconnaissance → Information gathering about the target
    2. Weaponization → Creating the malicious payload
    3. Delivery → Sending the malicious payload to the target
    4. Exploitation → Executing the malicious payload
    5. Installation → Installing malware to maintain access
    6. Command and Control (C2) → Establishing communication with the compromised system
    7. Actions on Objectives → Performing final objectives like data exfiltration or further compromise

Stakeholder Management

• Stakeholder management involves working with stakeholders, or those who have an interest in the event or impacted systems or services

Disaster Recovery Plan

• It identifies how to recover critical systems after a disaster & often prioritizes services to restore after an outage
• Testing validates the plan
• The final phase of disaster recovery includes a review to identify any lessons learned & may include an update to the plan
• Disaster recovery is a part of an overall business continuity plan

Business Continuity Plan (BCP)

• Helps an organization to predict & plan for potential outages of critical services or functions
• The goal is to ensure that critical business operations continue & organization can survive the outage

Continuity of Operations Planning (COOP)

• Focuses on restoring mission-essential functions at recovery site after a critical outage
• Site Resiliency → If one site suffers a catastrophic failure, an alternate site can take over after the disaster.
• Ensures critical functions can continue or be rapidly resumed during and after disruptions
• COOP planning enhances organizational resilience, reduces financial losses, and helps maintain trust and confidence among stakeholders.

Retention Policies

• This policy identifies how long data is retained & sometimes specifies how it is stored
• Some laws mandates the retention of data for specific time frames. Proper data governance practices ensure that these time frames are known & followed

Objective 4.3

• syslog → This protocol specifies general log entry format & details on how to transport log entries
  • Originators → Any systems that sends syslog messages
  • Collector → Originators send syslog log entries to the collector → syslog server
  • Syslog protocol only specifies how to format the syslog messages & send them to the collector
  • Linux systems include the syslogd daemon which is the service that handles the syslog messages → etc/syslog.conf → var/syslog
• Syslog-ng → Extends syslogd, allowing a system to collect logs from any source
  • It provides correlation, routing abilities to route log entries, rich filtering capabilities, content-based filtering,
  • It supports TCP & TLS
• Rsyslog → Improvement for syslog-ng → Ability to send log entries directly into database engines
  • It supports TCP & TLS
• NXLog → Log Management Tool similar to rsyslog & syslog-ng → Supports Linux & Windows
  • It functions as a log collector & can be integrated with SIEM systems
• journalctl → Command that displays several log entries from different sources on Linux system
• Bandwidth Monitors → By comparing captures taken at different times, investigators can determine changes in network traffic.
  • PRTG and Cacti are both network monitoring tools that can provide bandwidth monitoring information.
  • Bandwidth monitors can help identify exfiltration, heavy and abnormal bandwidth usage, and other information that can be helpful for both incident identification and incident investigations.
• NetFlow → A feature available on many routers & switches that can collect IP traffic statistics & send them to NetFlow collector
  • Analysis software of NetFlow allows admins to view & analyze network traffic
  • Netflow data provides detailed information about the network traffic → Metadata → source and destination IP addresses, ports, protocols, timestamps, and the amount of data transferred
• sFlow → A sampling protocol → Provides traffic information based on a preconfigured sample rate
  • Ex. It may capture 1 packet out of 10 packets & send this sample data to the collector
  • As it captures & send only sample data, it is less likely to impact the device’s performance, allowing it to work on devices with high volume of data
• IP Flow Information Export (IPFIX) → Similar to NetFlow v9 → Replacement to NetFlow

Objective 4.5

Documentation / Evidence

• Legal Hold → Refers to a court order to maintain different types of data as evidence
  • Data retention policy applies here
• Admissibility → When collecting documentation & evidence, it’s essential to follow specific procedures to ensure that the evidence is admissible in a court of law
• Chain of custody → A process that provides assurances that evidence has been controlled & appropriately handled after collection
  • Forensics experts establish chain of custody when they first collect the evidence
  • It provides a record of every person who was in possession of a physical asset collected as a evidence → Chain of custody forms are forms that list every person who has worked with or who has made contact with the evidence that is a part of an investigation
  • A proper chain of custody procedure ensures that evidence presented in the court of law is the same evidence that security professionals collected
  • A well-documented chain of custody can help establish provenance for data, proving where it came from, who handled it, and how it was obtained.
• Provenance → Refers to tracing something back to its origin
  • The provenance of a forensic artifact includes the chain of custody, including ownership and acquisition of the artifact, device, or image
• Tags → A tag is places on evidence items when they are identified
• Sequence of Events
  • Timestamps
  • Time Offset → Provides info about how the timestamps are recorded
• Reports → After analyzing all the relevant evidence, digital forensics experts create a report documenting their findings
  • Includes TTPs of attackers

Acquisition and Preservation

• Order of Volatility → Refers to the order in which you should collect evidence
  • You should collect evidence starting with most volatile & moving to least volatile
  • Order of volatility from most to least:
    1. Registers, Cache → The contents of CPU cache and registers are extremely volatile, since they are changing all of the time. Literally, nanoseconds make the difference here. An examiner needs to get to the cache and register immediately and extract that evidence before it is lost.
    2. Routing Table, ARP Cache, Process Table, Kernel Statistics, Memory
    3. Temporary File Systems
    4. Disk
    5. Remote Logging and Monitoring Data that is Relevant to the System in Question
    6. Physical Configuration, Network Topology, and Archival Media
  • Old:
    • Cache → Data in cache memory including the processor & hard drive cache
    • RAM → Data in RAM used by OS & applications
    • Swap / Pagefile → Swap (pagefile) is the system disk drive → Extension of RAM & stored on hard drive
    • Disk → Data files stored on local disk drives & they remain there after rebooting
    • Attached Devices → USB drive also holds data when system is powered down
    • Network → Servers & shared folders accessible by users & used to store log files
• Data Acquisition →
  • Snapshot → Forensic experts use snapshots to capture data for forensics analysis
  • Artifacts → Forensics artifacts are the pieces of data on a device that regular users are unaware of, but digital forensic experts can identify & extract
    • Web History
    • Recycle Bin
    • Windows Error Reporting
    • Remote Desktop Protocol (RDP) cache
  • When artifacts are acquired as part of an investigation, they should be logged and documented as part of the evidence related to the investigation.

On-Premises Versus Cloud Concerns

• Right to Audit Clauses → Allows customers to hire an auditor & review the cloud provider’s record
  • Auditing helps customer to ensure that the cloud provider is implementing adequate security
  • Many cloud service providers do not allow customer-driven audits, either by the customer or a third party. They also commonly prohibit vulnerability scans of their production environment to avoid service outages.
  • Instead, many provide third-party audit results in the form of a service organization controls (SOC) report or similar audit artifact.
• Regulatory Jurisdiction → The company must comply with relevant laws
• Data Breach Notification Laws → This law requires organizations to notify customers about a data breach & take steps to mitigate the loss

Integrity

• Provenance → Refers to tracing something back to its origin

Others

• eDiscovery → Electronic Discovery → It is the identification & collection of electronically stored information
• Strategic Intelligence and Counterintelligence → Refers to collecting, processing & analyzing information to create long-term plans & goals
  • Counterintelligence activities assume that attackers are also using strategic intelligence methods.