Incident Response Flashcards
Incident response
- Digital forensics professionals may or may not be involved directly with incident response (IR), although should be familiar with processes and procedures
depending on the work place you could have:
- A team dedicated to IR
- A team that deals with cyber security and IR
- A team that deals with IR and the digital forensics that follows
- An outsourced team that deal with cyber security, IR and digital forensics
- Or work in the lab and have artefacts handed to you to work on
what is IR in digital forensics
Incident response is as the name implies, about how an incident is responded to
what is an incident
- Data breach
- DDoS attack on a network
- Malware infection
- Unauthorised access
- Murder, robbery, fraud…
dealing with an incident
- Varies depending on job role and incident
- First digital forensics person there if you are asked to attend scene
- Public sector- crime scene
- Private sector- the organisation building, policy violations might not realise until investigating laws and policies are broken
6 stages of incident response
- Plan
- Respond
- Acquire
- Analyse
- Report
- Learn
Cyber security may have different stages to digital forensics.
stage 1- preparation
- Always have a plan
- Have some tools, what tools you have depend on some factors- what you can use, what you need to do and what you can afford
- Set up your lab ‘go bag’ light and heavy (tools you’ll take to an incident) and work area
- Have some procedures in places and a flow of what happens when
- An organisation may have a set of policies that will feed into your plans and procedures, you should also follow ACPO and the law
An IR plan
- What does what and when
- You’ll have a mission statement
- Incident severity list
- Communication tree
A plan
A plan might list incidents in order of severity, prioritising dealing with certain aspects in particular ways depending on how severe the incident is. This may also depend on the size of your team! If you within an organisation that has some policies then these will direct your plan as well as preserving any evidence and the process of how you work.
Mission statement
A mission statement could be:
“Mitigate as many vulnerabilities as possible, whilst keeping the organisations reputation intact, and then providing all the evidence to deal with the perpetrators of the incident(s) appropriately.“ This will be something specific to your team and organisation and as your plan develops over time, your mission statement will likely change too. If you are just doing the digital forensics and another team is working on the security aspect then they will be doing the mitigating part and whilst doing so looking after the reputation aspects, leaving your team to purely focus on the evidence collection, preservation and analysis.
communication tree
You might also have a communication tree, so everyone in the team and externally who will be part of the incident response plan knows who they need to communicate with and report to, along with the appropriate contact information so this communication can happen easily. This communication tree should show the team structure and where any higher up approval is needed, for example from stakeholders.
your field tool kit- think ACPO
- All the tools you might need that: You can use Are reliable Are verifiable Help you do your job effectively
procedures
Think flow charts- need to think about the steps you take when running an investigation, might adopt pre-defined procedural chart. Or customise or create one yourself
stage 2-respond - the call out
- You get a call out receive the brief and have to get there quickly
- Read the brief, make notes to decide how many team members you will need and a quick plan
- Evidence bags will probably be needed, know your team in order to work together effectively to recover evidence efficiently and quickly whilst following documentation and ACPO
- Need to check a warrant gives you the ability to collect enough devices at a crime scene- don’t be too specific but be specific enough for the warrant to be granted
- IPA2016, communication devices and their data have set reasons you can collect them
stage 2- respond- at the crime scene
- Sketch
- Photograph
- Contemporaneous notes
- Evidence forms
- Chain of custody
- Bag & tag
