Module 6 - Incident Response Toolkit Flashcards
Characterize the importance of Federal Rule of Evidence 702 / Daubert to toolkits. Compare and contrast the goals of various incident responders and the consequently the tools that will be used. Examine the list of underlying Dynamic Link Libraries associated with an application. Create an incident response CD, which can be used with a jump kit.
Difference in way personnel handle incidents
Help Desk - may download tools to system
Consequences: have to separate what they did
IR Toolkits
- preparation phase
- tested tools with small footprint
- for different OS’s
Toolkit requirements
must comply with FRE 702
Daubert
Daubert
Daubert
- Whether the expert’s technique or theory can be or has been tested—that is, whether the expert’s theory can be challenged in some objective sense, or whether it is instead simply a subjective, conclusory approach that cannot reasonably be assessed for reliability;
- Whether the technique or theory has been subject to peer review and publication;
- The known or potential rate of error of the technique or theory when applied;
- The existence and maintenance of standards and controls; and
- Whether the technique or theory has been generally accepted in the scientific community.
Tool selection / implementation
stand-alone tools preferred
burn to CD (non-writable)
rename names of tools so tracked
Run as Administrator
Statically-linked vs Dynamically-linked executables
Statically - self-contained, contains all the code necessary to successfully run as a standalone program. (better - because limit the footprint on the suspicious computer, don’t rely on files that may be compromised).
dynamic - uses loaded libraries within the computer’s memory to run.
Tools for inclusion
- tool to make forensic copy
- memory capture
- capture volatile data
- netcat or another tool to pass data across the wire
- Live CD
Testing
- preassemble tools
- run in controlled environment
- document results
Updating Tools
- keep historical library of old toolkits
- requires new testing
- maintain revision numbers or dates to toolkits
Tools for Incident Response CDs
- Sysinternals
- MIR-ROR (Motile Incident Response- Respond Objectively, Remediate)
- Mandiant
- Redline
- Memoryze
- IOC Finder
- AccessData - FTK Imager
- F-Response
- EnCase Enterprise
Toolkits beyond CDs
- network packet capture
- laptops
- USB flash drives with known s/n
- network cables
- cross-over cables
- hubs
- external media
- IP - or server to receive data
