Computer Security Incident
DEFINITIONCOMPUTER SECURITY INCIDENT“Any real or suspected adverse event in relation to the security of computer system orcomputer networks”- (According to ‘CIRT FAQ’) in CERT/CCA single or a series of unwanted or unexpected computer security events that have asignificant probability of compromising business operations and threateningcybersecurity.- ISO Definition
There are no standard types for security Incidents!
INTRODUCTIONIncident SamplesScan activity to firewall serversWeb defacementInformation leakagePhishing sitesCompromised serverEspionageIntrusionDoS / DDoS attacksUse of proxy server as open proxySMTP relayVirus infectionSPAMLaptop TheftMalware distributionBotnet and C&COne-Click FraudIdentity TheftUnauthorized Access
INTRODUCTIONINCIDENT RESPONSEProcess of addressing computer security incidentsDetectAnalyseLimitGoals: GeneralObservesystem for unexpected behaviour or anything Progress of the incident is haltedsuspicious Affected systems return to normal operations Investigate anything considered unusual If the investigation finds something that isn’t explained byauthorized activity, immediately initiate response procedures
INCIDENT RESPONSENEED FOR INCIDENT RESPONSE Even the most vigilant, secure organizations can come up against acts of fraud, theft, computer intrusions, and othercomputer security incidents. Without up-front planning for Incident Response, it is much more difficult to recover from an incident.
INCIDENT RESPONSEPOLICIES & PROCEDURES Established procedures must be in place to: Detect & identify the attack Mitigate the damageThese procedures used in incident response can be thought of Recover from the attackas the incident handling life cycle. Without a formal process in place critical information may be lost
INCIDENT RESPONSEINCIDENT HANDLING LIFE dentReportResolutionIDSHotline/HelpdeskCall CenterVulnerabilityReportObtain ContactInformationCoordinateinformation& ResponseProvide TechnicalAssistanceSource: CERT/CC Incident Handling Life Cycle in CERT/CC “Handbook for Computer Incident Response Teams (CIRTs)
INCIDENT RESPONSESAMPLE OBJECTIVES Provide support for recovering from and dealing with incidents Provide technical support in response to computer security incidents Help to stop attack Contain the damage The objective for the Incident Response will be derived from the CIRT mission statement
INCIDENT ficationNo consensus has emerged in the security community as towhich taxonomy is the bestPrioritisation of incidents is based on multiple factors.Classification of an incident is done based on the mission,operation field and other related elements.
INCIDENT HANDLING
INCIDENT HANDLINGPLAYERS INVOLVEDAttackerVictimLEAA ReporterYour CIRTISPIH ProcedurePlayersOther CIRTs
INCIDENT HANDLINGLIFECYCLE IN A CIRT PERSPECTIVEPreparationFollow UpReceiving &TriageEradication &RecoveryIdentification& AnalysisContainment
INCIDENT HANDLINGPREPARATIONTo respond to incident, the incident handling methodologies are very important. Communication & Facilities Email Telephone Internal Communication POC (Point of Contact) List Hardware & Software Incident Response Systems Information Gathering Systems Mail / Web /dB Servers Monitoring system Remote Access Printer & FAX Shredder Whiteboard & Projector Notebook Computers Policy & Procedure Security PolicySecurity PlanIncident Response PolicyIncident Response PlanResource AvailabilityCapacity BuildingRFC 2350 "Expectations for Computer SecurityIncident Response” Types of Incidents and Level of Support Co-operation, Interaction and Disclosure ofInformation Communication and Authentication
INCIDENT HANDLINGPREPARATIONTo respond to incident, the incident handling methodologies are very important. Building Relationship with key players Incidents checklist Law Enforcement Checklists are guidelines Human Resource Incident checklist are like memory System Administratorsjoggers Legal Counsel Don’t use checklist as the 10 Fellow Incident HandlersCommandmentsIncidentneed to practice workingincidentsto hone their skills. ResponsehandlersKit Performthreat modeling Onsite Whatare the kindsof attacks?One waytoassignmentsdo this is to take part in cyber drillat securityconferences. Quick withResponseEnablersthe team sessions.mightAlso workotherincident handlers in the Whatareaaretothesetincidentup practice Communication Planencounter – technical and physical? In-band Communication How will we prepare for the incident? Out-band Communication How will we identify the incident? Build a central point of contact How will we contain the incident? How will we eradicate the incident? How will we recover from the incident? How will we capture the lessons learnedfrom the incident?
INCIDENT HANDLINGINCIDENT RESPONSE STRUCTURE: EXAMPLE
INCIDENT HANDLINGINCIDENT HANDLING SYSTEMS
INCIDENT HANDLINGBASICSReceivingTriageIdentification& AnalysisContainmentEradication &RecoveryFollow Up
INCIDENT HANDLINGBASICS : PREPERATIONTo respond to incident, the incident handling methodologies are very important Communication & Facilities External InternalTemplateHardware & SoftwarePolicy & Procedure
RECEIVINGINCIDENT HANDLING
INCIDENT HANDLINGRECEIVINGElements that allow the CIRT to receive incidents.CIRT can rely on humans/machines/autonomus systems to report incidents.Some of the common systems that allows the CIRT to receive incidents are: PhoneEmailPortalFaxSMS
INCIDENT HANDLINGTYPICAL INCIDENT REPORTING FORMATContact Info NameOrganization NameDivisionE-mail address or FAX numberPurpose of Reporting QuestionInformation providingRequest to coordinationOtherSummary of the Incident Source IP address or hostname Description about the incident System information of the system IP address or hostname Protocol / Port number Hardware / OS Timestamp Time zoneLog Information
TRIAGEINCIDENT HANDLING
INCIDENT HANDLINGTRIAGEIn hospital, where patients who need to be attended immediately are separated from thosewho can wait for assistance. Sorting, Categorizing, Prioritizing Depending on resources available Type Incident, Vulnerability, Virus, Information New report or related on-going report? If on-going report, is it part of an existing Incident? Same IP address? Linkage between separate reports Tracking number?
INCIDENT HANDLINGTRIAGETriage helps the incident handlers optimize the time taken for incident handling as well asperform effective incident handling.CategorizationIncidentPriorityHuman ResourceRelevanceIdentify & Track
INCIDENT HANDLINGTRIAGE: PRIORITYDue to limited resource and the growing number of incident reports, we may not be able to respond to every incidentsreported to us. Resource needed to deal with itImpact on constituencyCategory of incidentType or extent of damageTarget or source of an attack
INCIDENT HANDLINGTRIAGEClassification vs. Categorization
INCIDENT RESPONSEELEMENTSIncident Class(mandatory input field)Incident Type(optional but desired input field)Description / ExamplesSpamor "Unsolicited Bulk Email", this means that the recipient has not granted verifiable permission forthe message to be sent and that the message is sent as part of a larger collection of messages, allhaving an identical content.HarassmentDiscreditation or discrimination of somebody (i.e. Cyberstalking)Child/Sexual/Violence/.Child Pornography, glorification of violence, .Abusive ContentVirusWormMalicious CodeTrojanSoftware that is intentionally included or inserted in a system for a harmful purpose. A userinteraction is normally necessary to activate the code.SpywareDialerScanningAttacks that send requests to a system to discover weak points. This includes also some kind oftesting processes to gather information about hosts, services and accounts. Examples: fingerd, DNSquerying, ICMP, SMTP (EXPN, RCPT, ).SniffingObserving and recording of network traffic (wiretapping).Social EngineeringGathering information from a human being in a non-technical way (e.g. lies, tricks, bribes, orthreats).Information Gathering
INCIDENT HANDLINGTRIAGE: PRIORITYHigh Urgent report like phishingIncident still activeHave to coordinate to other organizationMiddle Not urgent reportNot active incidentWill coordinate to other organizationLow Just a technical question to answerJust a FYI to usOthers
LETS DO A QUICK EXERCISETRIAGE AND INCIDENT HANDLING
INCIDENT HANDLINGTRIAGE: CLASSIFICATIONIncident Class(mandatory inputfield)Abusive ContentIncident Type(optional but desired inputfield)Description / ExamplesSpam‘Unsolicited bulk e-mail’, which means that the recipienthas not granted verifiable permission for the message to besent and that the message is sent as part of a largercollection of messages, all having an identical content.HarassmentDiscrediting, or discrimination against, somebody (ie, cyberstalking)Child/Sexual/Violence/.Child pornography, glorification of violence, .VirusWormMalicious CodeTrojanSpywareDialerSoftware that is intentionally included or inserted in asystem for a harmful purpose. A user interaction isnormally necessary to activate the code.
INCIDENT HANDLINGTRIAGE: CLASSIFICATIONIncident Class(mandatory inputfield)InformationGatheringIncident Type(optional but desired inputfield)Description / ExamplesScanningAttacks that send requests to a system to discover weakpoints. This includes also some kinds of testing processes togather information about hosts, services and accounts.Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT)SniffingObserving and recording network traffic (wiretapping).Social EngineeringGathering information from a human being in a non-technicalway (eg, lies, tricks, bribes, or threats).Exploiting KnownVulnerabilitiesAn attempt to compromise a system or to disrupt any serviceby exploiting vulnerabilities with a standardised identifiersuch as a CVE name (eg, buffer overflow, backdoors, crossside scripting, etc).Login AttemptsMultiple login attempts (Guessing or cracking passwords,brute force).New Attack SignatureAn attempt using an unknown exploit.Intrusion Attempts
INCIDENT HANDLINGTRIAGE: CLASSIFICATIONIncident Class(mandatory inputfield)InformationSecurityFraudOtherIncident Type(optional but desired inputfield)Description / ExamplesUnauthorised Access toInformationBesides the local abuse of data and systems, informationsecurity can be endangered by a successful account orapplication compromise. Furthermore, attacks that interceptand access information during transmission (wiretapping,spoofing or hijacking) are possible.Unauthorised Modification ofInformationUnauthorized Use of ResourcesUsing resources for unauthorised purposes, including profitmaking ventures (eg, the use of e-mail to participate in illegalchain letters for profit or pyramid schemes).CopyrightSelling or installing copies of unlicensed commercial softwareor other copyright protected materials (Warez).MasqueradeType of attacks in which one entity illegitimately assumes theidentity of another in order to benefit from it.All incidents which do not fit inone of the given categoriesshould be put into this class.If the number of incidents in this category increases, it is anindication that the classification scheme needs to be revised.
INCIDENT HANDLINGTRIAGE: RESPONSE LEVEL CLASSIFICATIONCriticalityLevelCriticality LevelDefinitionTypical cting criticalsystems orinformationwith potentialto be revenueor customerimpacting. Denial of60serviceMinutes CompromisedAsset (critical) InternalHacking(active) ExternalHacking(active) Virus / Worm(outbreak) Destructionof property(critical)OngoingResponse(Critical nicationRequirementCIRT IncidentManagerassigned towork case on24x7 basis.CIRT IncidentManagerassigned towork on caseduring normalbusiness hours.Case updatesent toappropriateparties on adaily basisduring criticalphase. If CSIRTinvolvement isnecessary torestore criticalsystems toservice thencase update willbe sent aminimum ofevery 2 hours.
INCIDENT HANDLINGTRIAGE: RESPONSE LEVEL CLASSIFICATIONCriticalityLevelCriticality LevelDefinitionTypical se(Critical nicationRequirement2Incidentaffecting noncritical systemsor information,not revenue orcustomerimpacting.Employeeinvestigationsthat are timesensitive shouldtypically beclassified at thislevel. InternalHacking (notactive) ExternalHacking (notactive) Unauthorizedaccess. Policyviolations Unlawfulactivity. Compromisedinformation. Compromisedasset. (noncritical)4 HoursCIRT IncidentManagerassigned towork case on24x7 basis.CIRT IncidentManagerassigned towork on caseduring normalbusiness hours.Case updatesent toappropriateparties on adaily basisduring criticalphase.Case updatesent toappropriateparties on aweekly basisduringresolutionphase.
INCIDENT HANDLINGTRIAGE: RESPONSE LEVEL CLASSIFICATIONCriticality Criticality LevelLevelDefinitionTypical se(Critical nicationRequirement3 Email48 HoursCase is workedas CIRTtime/resourcesare available.Case is workedas CIRTtime/resourcesare available.Case updatesent toappropriateparties on aweekly basis.Possibleincident, noncritical systems.Incident oremployeeinvestigationsthat are not timesensitive. Longterminvestigationsinvolvingextensiveresearch and/ordetailed forensicwork. ForensicsRequest Inappropriateuse ofproperty. Policyviolations.
INCIDENT HANDLINGTRIAGE: SENSITIVITY nitionTypical Incident CategoriesRequired OnCaseCommunicationOptional OnCaseCommunicationITS Access1ExtremelySensitive. Global InvestigationsInitiated. Forensics Request Destruction of property. Compromised asset. Compromisedinformation. Unlawful activity. Inappropriate use ofproperty. Policy violationsCIRT, CPOCCIRTMCIRT, CIRTM2Sensitive. External Hacking Internal Hacking Unauthorized AccessCIRT, t Sensitive. Denial of service. Virus / Worm EmailCIRT, CPOCANYALL Agents inITS
IDENTIFICATION & ANALYSISINCIDENT HANDLING
INCIDENT HANDLINGIDENTIFICATION & ANALYSIS Assign a handler in charge of responding / handling the incidentCollect / Gather evidence Audit trail, log files, contents of files Survey situation on victim siteIdentify What, Who, When, Why, How
INCIDENT HANDLINGIDENTIFICATION & ANALYSISIncident Analysis Profile Network and Systems Understand Normal Behaviours Use Centralized logging and Create a Log Retention Policy Perform Event Correlation Keep All Host Clocks Synchronized Maintain and Use a Knowledgebase of Information Use Internet Search Engines for Research Run Packet Sniffers to Collect Additional Data Consider Filtering the Data Consider Experience as Being Irreplaceable Create a Diagnosis Matrix for Less Experienced Staff Seek Assistance From Others
INCIDENT HANDLINGIDENTIFICATION & ANALYSISEvidence Collection and Archiving (RFC 3227) Order of Volatility Registers Routing table Temporary file systems Disk Remote logging Physical configuration Archival media Things to avoid It's all too easy to destroy evidence (fragile). Privacy Considerations Respect the privacy rules Do not intrude on people’s privacy without strong justification Make user backing of procedure that company’s established. Legal Considerations Computer evidence needs to be Admissible, Authentic, Complete, Reliable and Believable.
CONTAINMENTINCIDENT HANDLING
INCIDENT HANDLINGCONTAINMENTCreating a containment strategyMeans ofContainmentType of incident Shut down system Disconnect System/PC from network Disable certain functionsStrategy for virus infection and the strategyfor denial of service attack are not the same.
INCIDENT HANDLINGCONTAINMENTCriteria for determining the strategy include: Potential damage to resourceTheft of resourcesNeed for evidence preservationService availability Time and recourses needed to implement the strategyEffectiveness of the strategy (e.g.) Network connectivity, service provided to others(e.g.) Partial or full containmentDuration of the solution (e.g.) To be removed in several week
INCIDENT HANDLINGCONTAINMENTDelayed containment is usually NOT good. Need additional evidence to do containment?Need to get approval from legal section?If so (above), attacker could escalate unauthorized access / compromise other system inshort time Other potential issues Some attacks may cause additional damage when contained (e.g. disconnected).
ERADICATION & RECOVERYINCIDENT HANDLING
INCIDENT HANDLINGERADICATION & RECOVERYDetermine case & origin of incident by EvidenceEspecially, the detailed log should be kept for all evidences, including: Identifying information Location serial number host nameREFERENCE MAC addressRFC 2337“Evidence Collection and ArchivingIP address Name Title phone number Time and date Including time zoneLocation where evidence was stored
INCIDENT HANDLINGERADICATION & RECOVERYExample of eradication Delete malicious codeDisable breached user accountRestore the system Rebuild systems from scratchReplace compromised files with clean versionsInstall patchesChange passwordsTighten network perimeter security Configuration of firewall & routerHigher levels of system logging or network monitoring
INCIDENT HANDLINGERADICATION & RECOVERYWhich method would you recommend?1)There is a rootkit inside a particular computer.2)Your nations tourism department website has been defaced.3)The email address of all the users in the prime ministers office has been leaked out.
FOLLOW UPINCIDENT HANDLING
INCIDENT HANDLINGFOLLOW UP: DOCUMENTATIONDocument what occurred in detail, including: Unique incident tracking number Keywords or categorization Information to characterize the incident Establish relationships between difference incidentsContact information To track all information and actions relating to the incidentName, Phone number, Email address, Other Contact information for all partiesPolicies Legal parameters or policies that the way incident might be handled
INCIDENT HANDLINGFOLLOW UP: DOCUMENTATION Incident history Status Current status of the incidentActions Chronicle of all email and other correspondenceList of past, current, and future actions to be takenIncident coordinator A team may choose to assign a staff member to coordinate the response to thisincident Quality assurance parameters Information that might help to measure the quality of the service
INCIDENT HANDLINGFOLLOW UP: COMMUNICATIONEnsure that the restored system is no longer vulnerable to the same attack type. Monitor the restored system.Provide the updated information, including: Relevant incident Vulnerability patch Security patch Different solution
INCIDENT HANDLINGFOLLOW UP: SELF LEARNINGLesson Learned Post-mortem after the incident is resolved.The meeting is helpful in improving security measures and the incident handling processitself. Assess time and resources used and damage incurred.Update policy and procedures as necessary.Update knowledgebase.Be prepared for media inquiries
COMPUTER SECURITY INCIDENT DEFINITION "Any real or suspected adverse event in relation to the security of computer system or computer networks" - . Source: CERT/CC Incident Handling Life Cycle in CERT/CC "Handbook for Computer Incident Response Teams (CIRTs) Other IDS Hotline/Helpdesk Call Center Email Triage Information
Incident Management Process Map 1. Incident Management Process Map 1. Incident Management Description and Goals 9. Incident Management Description and Goals 9. Description 9. Description 9. Goals 9. Goals 9. Incident Management RACI Information 10. Incident Management RACI Information 10. Incident Management Associated Artifacts Information 24
Incident handling requires people, process and technology. 36 Security Operation Centers Well-Defined Methodology ISO/IEC 27035:2011 Information technology -- Security techniques -- Information security incident management ards ENISA Good Practice Guide for Incident Management NIST SP 800-61 Rev. 2 Computer Security Incident Handling Guide
assists organizations in establishing computer security incident response capabilities and handling incidents efficiently and effectively. This publication provides guidelines for incident handling, particularly for analyzing incident-related data and determining the appropriate response to each incident.
assists organizations in establishing computer security incident response capabilities and handling incidents efficiently and effectively. This publication provides guidelines for incident handling, particularly for analyzing incident-related data and determining the appropriate response to each incident.
NIST SP 800-61 «Computer security incident handling guide» represents the collection of the best practices in the field of construction of processes of reaction to computer security incidents [3]. However IS incident is wider than computer security incidents. The group of software and technical incidents, including computer
planning, incident mitigation, and resource availability. The Incident Management Program is structured to assist the system entities, as well as provide a well- rounded incident management platform. e. System Incident Management Oversight and Authorities The System Incident Management staff is comprised of a Division of the Corporate Security
CIRT - Computer Incident Response Team IHT - Incident Handling Team IRC - Incident Response Center or Incident Response Capability . Stakeholders, roles and responsibilities (i.e. who will take part in it) Resource, financial and quality plans (i.e. how it will be achieved) .
7 Annual Book of ASTM Standards, Vol 14.02. 8 Discontinued 1996; see 1995 Annual Book of ASTM Standards, Vol 03.05. 9 Annual Book of ASTM Standards, Vol 03.03. 10 Available from American National Standards Institute, 11 West 42nd St., 13th Floor, New York, NY 10036. 11 Available from General Service Administration, Washington, DC 20405. 12 Available from Standardization Documents Order Desk .
