Download IR/Forensics Team Tactics Panel

IR/Forensics Team Tactics Panel
Best Incident Response and Forensics Techniques
Eric Gentry
[email protected]
Christopher J Novak
[email protected]
Confidential and proprietary material for authorized Verizon Business personnel only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.
Quickly Determining What Type of
Data Was Compromised
Know What/Where Sensitive Data Resides in Environment
 Network Diagram
 Map Data Flows
Forensic Analysis
Identify / Analyze Corroborating Sources
 Netflows, IDS and Firewall Logs, etc.
 Web Server Logs
 Database Content
Confidential and proprietary material for authorized Verizon Business personnel only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.
Determining How a Breach Occurred
Malware Analysis
 Analysis in Sandbox Environment
 IP Addresses
 Filenames, Processes
 Hacker Handles
Leverage Other Intelligence Sources
 Underground Monitoring
 Coordination with Law Enforcement
 e.g. Known Information Black Market forums
Circumstantial Evidence
 Overall Security Posture
Confidential and proprietary material for authorized Verizon Business personnel only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.
Identify Malware on Hosts
Forensic Analysis




Known Keywords
Analysis of File Times/Dates
Known “Bad” IP Addresses
Known Malware Hash Values
Other Evidence Sources
 Web Server Logs
 Application Logs
Confidential and proprietary material for authorized Verizon Business personnel only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.
Thank You
Eric Gentry
[email protected]
Christopher J Novak
[email protected]
Confidential and proprietary material for authorized Verizon Business personnel only. Use, disclosure or distribution of this material is not permitted to any unauthorized persons or third parties except by written agreement.