Plan for the next breach with incident response forensics

The only thing worse than a data breach is not knowing how it happened.

In order to prevent system failure, minimize the loss and prevent similar breaches, agencies need an incident response plan that includes forensic investigation.

To start, IT managers must decide if they have the resources to establish an in-house forensic response unit, if outsourcing is the most viable option or if a combination of the two is best. Building an information security forensics lab is an expensive undertaking, which is why some agencies outsource that capability to specialized vendors.  

Whether in-house or outsourced, there are several prerequisites for establishing effective forensic investigations.

Risk management plan: Agencies should have documented their computer systems in a risk management plan and be able to catalog where all sensitive data and files reside. In the case of a data loss breach, this information allows the security analyst to reasonably ascertain, in a timely manner, what and how much data might have been compromised.

Response time: Aside from the obvious need for physical server access and the ability to scan logs and pull data from devices, response time is critical. Wasted minutes cost productivity, money, reputation and business.

Training: IT emergency response team personnel (information security analysts, IT engineering and networking personnel, application developers, etc.) must be well coordinated and be able to effectively collect all network traffic data and contain an incident.

Documentation: An agency’s response plan must be thorough in documenting processes and procedures for conducting a forensic investigation. 

Based on these prerequisites, conducting a successful forensic investigation then relies upon the application of investigation and analysis tools and techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law.

Agencies that have their own security forensic capability should have an arsenal of technical tools, including:

• Forensic software designed to build a case investigation file;
• Forensic toolkits that can read firewall, intrusion detection and antivirus logs;
• A network flow and traffic analyzer;
• Security information and event management (SIEM) loggers/collectors;
• Non-signature malware detection devices;
• E-discovery software; and
• Adequate disk space to enable the forensics analyst to review months of network traffic, if required.

The goal of computer forensics team is to perform a structured investigation while maintaining a documented chain of custody of evidence, and to find out exactly what happened on a computing device and who was responsible for it.

Forensic investigators typically follow a standard set of procedures. After physically isolating the device in question to make sure it cannot be accidentally contaminated, a digital copy is made of the device's storage media. Once the original media has been copied, it is locked in a secure location as evidence. All investigative procedures are then performed on the digital copy.

To authenticate the evidence, the investigator calculates a cryptographic hash value for the data that resides on the target computer system. Once the data acquisition has been completed, a hash needs to be calculated for the copy of the original media. The hash values need to be equal to assure that a true bit-for-bit, accurate copy of the data has been made.

Next the forensic investigators examine the disk copy to search hidden folders and unallocated disk space for deleted, encrypted or damaged files. Any evidence found on the digital copy is carefully documented (and verified with the original) in preparation for possible legal proceedings that involve discovery, depositions or actual litigation.

To be completely thorough, the forensics investigator begins the analysis on the captured data. The objective at this stage can vary. It can be as simple as finding Internet browser history, cookies and cache files to document improper web surfing, or it can be as complex as identifying the works of a skilled adversary in a full-blown investigation of a major breach. This kind of investigation can require data synthesis from various sources, piecing together firewall logs, system event logs, network session data and information hidden on a local host to determine exactly what and how the breach happened. There are many places where “digital footprints” are left.  Truly skilled investigators can uncover the tracks, if given adequate time and if the proper tools and techniques are used to acquire the data.     

Finally, depending upon the outcome requirement, an agency may need to prepare and present the evidence. If the agency is not seeking prosecution, a presentation may simply entail creating a final report for upper level management. If the evidence will be used in a legal proceeding and presented to a judge and/or jury, an “evidence finding report” would be required.

Whether conducting a forensic investigation in-house or outsourcing the effort to a vendor, agencies are recognizing the growing need for digital forensics. While the costs of the necessary tools and skilled personnel can be high, understanding the forensics capability is a key part of understanding what is required when a breach -- of any size -- occurs.