Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2016-08-24 InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
ISC Stormcast For Thursday, August 25th 2016 http://isc.sans.edu/podcastdetail.html?id=5139

New VMware Patches VMSA-2016-0009.4 VMSA-2016-0013 http://www.vmware.com/security/advisories.html

Published: 2016-08-24
Last Updated: 2016-08-24 12:51:04 UTC
by Tom Webb (Version: 1)
0 comment(s)
Keywords:
0 comment(s)

Stay on Track During IR

Published: 2016-08-24
Last Updated: 2016-08-24 12:23:45 UTC
by Tom Webb (Version: 1)
1 comment(s)

When responding to incidents, it’s easy to go down a rabbit hole that likely won’t produce results to the questions we are always after: How did the attacker get in? What information is contained on the system? And What information was accessed?

 

To streamline analysis we need to determine what information is most useful for each incident classifications, this gives more flexibility to SOPs by pulling these into a methodology depending on the investigation. Rather than adding these processes over and over into different procedures documents (which all may not get updated) you can link to one process from the methodology.

 

Additionally, you can chart out specific items (e.g. determine logged-in username for computer) similar to the SANS forensics poster for where to get specific data for user activity. (P is primary source. S is secondary)


 

 

FW Log

IDS

HID

BRO

DHCP

NAC

Full

Packet

SMTP

Logs

DNS

AD

DLP

Phish

   

S

P

   

P

P

S

   

Web Shell

S

S

S

P

   

P

       

C&C

S

S

 

P

   

P

 

P

   

Data

Exfil

S

 

P

S

   

P

       

Logged-in user

   

S

   

P

     

P

 

 

 

Do anyone else use a similar process or have a better one?Leave a comment.

 

--

Tom Webb

@twsecblog

1 comment(s)
ISC Stormcast For Wednesday, August 24th 2016 http://isc.sans.edu/podcastdetail.html?id=5137
Diary Archives