WEBVTT 1 00:00:00.000 --> 00:00:02.560 Okay, let's unpack this. You ever feel like you're just 2 00:00:02.600 --> 00:00:07.719 waiting through endless cybersecurity warnings, Oh yeah, data breaches here, 3 00:00:08.279 --> 00:00:11.000 some new kind of attack there, and you're left wondering 4 00:00:11.000 --> 00:00:11.880 what it all really means. 5 00:00:11.960 --> 00:00:13.800 Right, totally, it's overwhelming. 6 00:00:13.839 --> 00:00:15.599 Maybe you're trying to wrap your head around for work, 7 00:00:15.679 --> 00:00:18.000 or maybe you just want to feel a little less 8 00:00:18.000 --> 00:00:21.239 in the dark about the digital world we live in. Huh, well, 9 00:00:21.879 --> 00:00:24.120 that's exactly what we're diving into today. 10 00:00:24.280 --> 00:00:29.679 Precisely. Think of this as your shortcut to understanding the 11 00:00:29.719 --> 00:00:33.560 core of how we tackle cyber incidents without getting lost 12 00:00:33.600 --> 00:00:35.240 in all the technical weeds. 13 00:00:34.840 --> 00:00:38.200 And today that core understanding comes from the world of 14 00:00:38.280 --> 00:00:40.479 digital forensics and incident. 15 00:00:40.119 --> 00:00:42.439 Response, right DFR. 16 00:00:42.799 --> 00:00:45.399 Now, your first thought might be that sounds like something 17 00:00:45.399 --> 00:00:47.840 for the tech giants, not me, but think of it 18 00:00:47.880 --> 00:00:53.920 this way. Understanding these principles is like understanding basic first date. 19 00:00:54.359 --> 00:00:55.439 That's great analogy. 20 00:00:55.520 --> 00:00:57.759 It might not be a doctor, but knowing what to 21 00:00:57.759 --> 00:01:00.960 do in an emergency can be crucial for anyone navigating 22 00:01:01.000 --> 00:01:01.920 our digital lives. 23 00:01:02.200 --> 00:01:04.719 That's a key point. I mean, while a major corporation 24 00:01:04.799 --> 00:01:08.000 faces threats on a different scale than say, an individual, 25 00:01:08.359 --> 00:01:12.480 the fundamental approach understanding what happened and how to respond. 26 00:01:13.400 --> 00:01:14.439 It has common. 27 00:01:14.159 --> 00:01:19.120 Threads, absolutely, and to help us navigate this fascinating but yeah, 28 00:01:19.159 --> 00:01:22.920 sometimes complex area, we've got a real treasure trove of information, 29 00:01:23.159 --> 00:01:27.120 most notably the book Digital Forensics and Incident Response, third. 30 00:01:27.040 --> 00:01:28.680 Edition, Solid resource. 31 00:01:28.799 --> 00:01:32.640 This isn't some surface level guide. It's a deep dive itself, 32 00:01:32.719 --> 00:01:37.640 covering everything from the nitty gritty of computer memory analysis 33 00:01:37.680 --> 00:01:39.680 to the strategic use of threat intelligence. 34 00:01:39.680 --> 00:01:42.560 It's definitely comprehensive. Our goal here is to pull out 35 00:01:42.560 --> 00:01:46.079 the most vital and frankly thought provoking aspects, giving you 36 00:01:46.120 --> 00:01:49.959 a clear pathway to being well informed without feeling overloaded 37 00:01:49.959 --> 00:01:51.040 by technical details. 38 00:01:51.159 --> 00:01:54.840 Yeah, aiming for that practical aha moment where things really 39 00:01:54.840 --> 00:01:57.840 click exactly. So, when something does go wrong in the 40 00:01:57.840 --> 00:02:00.959 digital realm, where do the experts even begin to sort 41 00:02:00.959 --> 00:02:01.280 it out? 42 00:02:01.519 --> 00:02:06.519 Okay, let's start with the thirty thousand foot view. Digital 43 00:02:06.560 --> 00:02:10.879 Forensics and Incident Response often shortened to DFIR. That's the 44 00:02:10.919 --> 00:02:14.919 overarching process organizations used to manage and resolve cybertax. 45 00:02:15.080 --> 00:02:17.039 DFIR the whole life cycle. 46 00:02:17.159 --> 00:02:19.280 Yeah, the entire life cycle of dealing with a digital 47 00:02:19.319 --> 00:02:20.080 security event. 48 00:02:20.120 --> 00:02:23.759 Okay, DFIR, the whole playbook for digital emergencies. What's like 49 00:02:23.879 --> 00:02:25.719 one of the first pages in that playbook. 50 00:02:25.800 --> 00:02:29.639 Well, a foundational element is the incident response or IR plan. 51 00:02:29.800 --> 00:02:33.159 The IR plan this is basically a documented roadmap. It 52 00:02:33.240 --> 00:02:37.319 outlines how an organization will prepare for, detect, contain, and 53 00:02:37.400 --> 00:02:42.120 recover from security incidents. A robust IR plan has several 54 00:02:42.639 --> 00:02:43.319 essential parts. 55 00:02:43.360 --> 00:02:45.599 Okay, lay them on us. What should a good IR 56 00:02:45.639 --> 00:02:46.439 plan include? 57 00:02:46.560 --> 00:02:50.800 Right? First and foremost preparation through training the team responsible 58 00:02:50.800 --> 00:02:55.000 for handling incidents, the Computer Security Incident Response Team or CSRT. 59 00:02:55.439 --> 00:02:56.400 They need to practice. 60 00:02:56.439 --> 00:02:58.479 Practice makes perfect, even in cyber. 61 00:02:58.280 --> 00:03:00.840 Absolutely, think of it like a sports team running drills. 62 00:03:01.000 --> 00:03:03.759 The book really highlights the value of tabletop exercises. 63 00:03:03.800 --> 00:03:06.280 Tabletop exercise like playing a game sort of. 64 00:03:06.560 --> 00:03:10.599 There's simulated incident scenarios that the entire CSART should walk 65 00:03:10.639 --> 00:03:16.800 through regularly, ideally annually. These exercises often reveal unexpected communication 66 00:03:16.919 --> 00:03:19.159 breakdowns or maybe unclear roles. 67 00:03:19.520 --> 00:03:21.800 Ah, so it's not just technical stuff, it's the human 68 00:03:21.879 --> 00:03:22.479 element too. 69 00:03:22.599 --> 00:03:26.960 Oh, definitely surprisingly effective. Communication under pressure is often a 70 00:03:27.000 --> 00:03:32.120 major stumbling block. Then there's maintenance. The digital landscape is 71 00:03:32.159 --> 00:03:37.680 constantly shifting, new technologies, evolving threats, personnel changes, you name it. 72 00:03:37.879 --> 00:03:38.919 The IR plan. 73 00:03:38.840 --> 00:03:40.400 Needs to keep up, so it can't just sit on 74 00:03:40.439 --> 00:03:41.000 a shelf. 75 00:03:41.439 --> 00:03:44.319 No way. The book recommends at least an annual review 76 00:03:44.319 --> 00:03:47.520 to ensure the plan remains relevant and effective, and lessons 77 00:03:47.599 --> 00:03:50.960 learned from exercises or you know, real incidents should be 78 00:03:51.000 --> 00:03:53.000 incorporated to make it a stronger document. 79 00:03:53.120 --> 00:03:56.439 Right, constantly updating based on experience makes sense exactly. 80 00:03:56.800 --> 00:03:59.520 And then we have playbooks. These are like specific step 81 00:03:59.520 --> 00:04:02.599 by step guides for handling common types of incidents. Think 82 00:04:02.639 --> 00:04:05.479 of it like having a checklist for different medical emergencies. 83 00:04:05.560 --> 00:04:06.120 Okay. Yeah. 84 00:04:06.120 --> 00:04:09.879 The book mentions playbooks for things like phishing attacks, malware infections, 85 00:04:10.000 --> 00:04:14.479 ransomware a big one, vulnerabilities and public systems and business 86 00:04:14.479 --> 00:04:16.759 email compromise or be EC. 87 00:04:17.120 --> 00:04:18.759 Ransomware gets its own playbook. 88 00:04:18.959 --> 00:04:22.199 It emphasizes the critical nature of ransomware and suggests a 89 00:04:22.240 --> 00:04:25.279 dedicated playbook for it. Yeah, just because of its potentially 90 00:04:25.319 --> 00:04:26.279 devastating impact. 91 00:04:26.360 --> 00:04:30.759 Okay. Playbooks the practical how to guides for when specific 92 00:04:30.839 --> 00:04:31.920 digital alarms go. 93 00:04:31.959 --> 00:04:36.000 Off precisely and within the IR plan. Clear escalation procedures 94 00:04:36.040 --> 00:04:37.000 are vital. 95 00:04:36.920 --> 00:04:39.120 Escalation, Who calls who? Basically? 96 00:04:39.199 --> 00:04:42.560 Yeah, pretty much? These define who needs to be notified 97 00:04:42.639 --> 00:04:46.439 and involved as an incident unfold from initial detection all 98 00:04:46.439 --> 00:04:49.639 the way to full blown crisis management. This helps prevent 99 00:04:49.720 --> 00:04:52.560 what the book calls see a shirt burnout burnout. 100 00:04:52.800 --> 00:04:53.720 Yeah, I can see that. 101 00:04:53.680 --> 00:04:57.199 Being a risk definitely. It ensures that the specialized skills 102 00:04:57.199 --> 00:05:01.160 of the team are deployed appropriately and important only when 103 00:05:01.240 --> 00:05:03.639 truly needed. It's like a tiered alert system. 104 00:05:03.800 --> 00:05:06.879 So when the ceesart does get engaged, what's the initial approach? 105 00:05:06.920 --> 00:05:07.839 How do they jump in? 106 00:05:08.000 --> 00:05:10.480 The book makes it pretty compelling comparison here, think of 107 00:05:10.560 --> 00:05:14.439 engaging a se sert like calling the fire department. You 108 00:05:14.519 --> 00:05:18.800 contact them, provide essential details, what's happening where, what's the 109 00:05:18.839 --> 00:05:24.399 potential impact? That info allows them to dispatch the right resources. Similarly, 110 00:05:24.839 --> 00:05:28.680 engaging a se sert follows a defined escalation path, making 111 00:05:28.680 --> 00:05:31.040 sure the right expertise is brought to bear. 112 00:05:31.160 --> 00:05:34.120 Like flagging a suspicious email that then gets escalated to 113 00:05:34.160 --> 00:05:36.480 a specialist for like a deeper. 114 00:05:36.199 --> 00:05:39.439 Look exactly, and once the seizert is on the scene, 115 00:05:39.560 --> 00:05:42.839 a primary objective in those early stages is to understand 116 00:05:42.920 --> 00:05:44.079 the scope of the incident. 117 00:05:44.279 --> 00:05:46.279 How bad is it, how far is it spread? 118 00:05:46.439 --> 00:05:48.920 Right Initially it might not be clear how far the 119 00:05:48.959 --> 00:05:52.519 compromise is spread. The CS conducts a systematic investigation to 120 00:05:52.600 --> 00:05:56.800 determine which systems data processes have been affected. They're essentially 121 00:05:56.800 --> 00:05:58.839 trying to map the boundaries of the digital fire. 122 00:05:59.040 --> 00:06:01.560 So they're like digital fire responders trying to contain the 123 00:06:01.639 --> 00:06:03.600 damage and figure out how big the problem. 124 00:06:03.279 --> 00:06:06.839 Actually is precisely, and for organizations with a more mature 125 00:06:06.879 --> 00:06:11.160 security posture, often those with a dedicated security operations center 126 00:06:11.360 --> 00:06:14.839 or SoC, or maybe a fusion center, there are technologies 127 00:06:14.879 --> 00:06:19.279 like Security Orchestration, Automation and Response or SR. 128 00:06:19.399 --> 00:06:22.040 SIR sounds like it takes a lot of the manual 129 00:06:22.079 --> 00:06:23.600 work out of incident response. 130 00:06:23.639 --> 00:06:27.759 That's the goal. Yeah. Gartner defines SOR as technologies that 131 00:06:27.800 --> 00:06:32.519 integrate incident response platforms, orchestration and automation of security tasks, 132 00:06:33.000 --> 00:06:36.639 and threat intelligence management into one unified. 133 00:06:36.160 --> 00:06:38.600 System, integrating everything right. 134 00:06:39.000 --> 00:06:43.879 It helps organizations streamline their response processes, manage incidents more efficiently, 135 00:06:44.000 --> 00:06:48.199 and even leverage automation to handle routine tasks that frees 136 00:06:48.279 --> 00:06:51.240 up human analysts for the more complex issues. 137 00:06:51.279 --> 00:06:53.639 And you can't just automate everything right point. 138 00:06:54.439 --> 00:06:57.600 A common pitfall is automating too much too soon. That 139 00:06:57.639 --> 00:07:01.160 can lead to inflexible playbooks that don't handle novel attacks effectively. 140 00:07:01.519 --> 00:07:02.959 So it's about smart automation. 141 00:07:03.160 --> 00:07:05.360 Smart automation, not yeah yeah exactly. 142 00:07:06.120 --> 00:07:09.160 So our platform typically includes an incident response platform for 143 00:07:09.199 --> 00:07:13.399 managing workflows and tracking investigations, a security orchestration and automation 144 00:07:13.519 --> 00:07:17.800 engine for automating tasks like isolating infected computers, and a 145 00:07:17.879 --> 00:07:21.480 threat intelligence platform for gathering and enriching information about threats. 146 00:07:21.839 --> 00:07:24.759 Automation insecurity. That makes a lot of sense for dealing 147 00:07:24.839 --> 00:07:27.959 with the sheer volume of alerts these days. Now, Okay, 148 00:07:28.279 --> 00:07:31.319 once you know you have an incident, a critical next 149 00:07:31.319 --> 00:07:33.759 step must be containing it, stopping the bleeding. 150 00:07:33.879 --> 00:07:37.199 Absolutely. Containment is about limiting the spread and impact of 151 00:07:37.199 --> 00:07:40.720 the attack. Think of it as building a firewall metaphorically speaking, 152 00:07:41.000 --> 00:07:42.639 around the affected areas you. 153 00:07:42.600 --> 00:07:45.040 Want to stop the digital infection from spreading further. 154 00:07:45.279 --> 00:07:50.120 The book discusses both physical and logical containment. Physical containment 155 00:07:50.199 --> 00:07:55.160 might involve actually physically disconnecting an infected machine from the network, 156 00:07:55.399 --> 00:07:58.839 unplugging the network cable or turning off Wi Fi one 157 00:07:58.879 --> 00:08:03.279 that plug. Yeah, but in large organizations, quickly locating and 158 00:08:03.399 --> 00:08:07.480 isolating multiple affected systems can be a huge logistical challenge. 159 00:08:07.519 --> 00:08:10.360 Oh yeah, imagine trying to find one compromised laptop in 160 00:08:10.399 --> 00:08:11.519 a massive office. 161 00:08:11.199 --> 00:08:15.319 Building precisely so, then you have logical containment. This involves 162 00:08:15.439 --> 00:08:20.480 using software configurations to isolate systems or network segments, for example, 163 00:08:20.680 --> 00:08:24.519 implementing new firewall rules or using network segmentation. 164 00:08:24.199 --> 00:08:25.360 Using software barriers. 165 00:08:25.680 --> 00:08:29.160 Right. This is often more scalable, but it does require 166 00:08:29.279 --> 00:08:32.399 a well designed network architecture in the first place. 167 00:08:32.360 --> 00:08:35.440 So it's often a combination of physically cutting off connections 168 00:08:35.960 --> 00:08:39.320 and using software to create those digital barriers. 169 00:08:39.320 --> 00:08:42.600 Correct and after the immediate crisis has been addressed, there's 170 00:08:42.639 --> 00:08:45.240 a vital step for learning and improvement called the after 171 00:08:45.320 --> 00:08:47.000 action review or AAR. 172 00:08:47.279 --> 00:08:49.399 The AAR, what's that involved? 173 00:08:49.480 --> 00:08:52.440 It's a structured process of looking back at the incident, 174 00:08:52.559 --> 00:08:56.000 what went well, what could have been handled better, and crucially, 175 00:08:56.039 --> 00:08:58.679 what changes need to be made to ce sart policies 176 00:08:58.679 --> 00:09:01.679 and procedures. The goal is continuous. 177 00:09:01.000 --> 00:09:03.639 Improvement, turning every incident into a learning. 178 00:09:03.399 --> 00:09:07.080 Opportunity, exactly making your security stronger over time, like a 179 00:09:07.120 --> 00:09:07.919 feedback loop. 180 00:09:08.039 --> 00:09:11.519 Got it? Okay? Now shifting focus slightly to the digital 181 00:09:11.559 --> 00:09:14.679 forensic side of dfire. You mentioned a principle. 182 00:09:15.039 --> 00:09:18.879 Ah, yes, there's a fundamental principle that underpins a lot 183 00:09:18.919 --> 00:09:21.240 of the work. Low cards exchange principle. 184 00:09:21.320 --> 00:09:23.919 Low cards exchange principle. Okay, sounds like something from a 185 00:09:23.919 --> 00:09:25.039 detective novel, It. 186 00:09:25.039 --> 00:09:27.600 Kind of is. It's a cornerstone of forensic science, stating 187 00:09:27.639 --> 00:09:29.519 that every contact leaves a trace. 188 00:09:29.759 --> 00:09:31.360 Every contact leaves a trace. 189 00:09:31.360 --> 00:09:34.559 In the digital world. This means that attackers, even if 190 00:09:34.559 --> 00:09:37.279 they try to be stealthy and cover their tracks, will 191 00:09:37.440 --> 00:09:42.679 inevitably leave digital footprints. The challenge and the skill of 192 00:09:42.720 --> 00:09:46.440 digital forensics lies in having the right tools and expertise 193 00:09:46.519 --> 00:09:49.120 to uncover these traces and connect them back to the 194 00:09:49.159 --> 00:09:50.200 malicious activity. 195 00:09:50.480 --> 00:09:53.360 So even deleting files or wiping a hard drive doesn't 196 00:09:53.399 --> 00:09:57.440 necessarily mean all evidence is gone for good not always no. 197 00:09:57.879 --> 00:10:01.320 Skilled forensic analysts can often rec covered deleted data or 198 00:10:01.399 --> 00:10:04.960 find remnants of malicious activity that might not be immediately obvious. 199 00:10:05.320 --> 00:10:07.759 It takes work, but it's often possible. 200 00:10:08.000 --> 00:10:10.600 Interesting and speaking of things that might not be obvious, 201 00:10:10.639 --> 00:10:14.080 you mentioned incident response has legal implications. 202 00:10:13.600 --> 00:10:15.440 Oh, absolutely significant one. 203 00:10:15.320 --> 00:10:17.519 John, Just dealing with the technical side, definitely. 204 00:10:17.720 --> 00:10:22.320 These can range from mandatory breach notification requirements, which depend 205 00:10:22.440 --> 00:10:25.279 heavily on the type and volume of data compromised and 206 00:10:25.399 --> 00:10:26.480 the jurisdiction right. 207 00:10:26.519 --> 00:10:28.200 Those laws seem to change all the time. 208 00:10:28.279 --> 00:10:31.519 They do, and then there are various privacy regulations, plus 209 00:10:31.600 --> 00:10:34.600 the rules of evidence if legal action is pursued. The 210 00:10:34.639 --> 00:10:38.039 book even mentions the Economic Espionage Act of nineteen ninety six, 211 00:10:38.240 --> 00:10:40.759 which criminalizes the theft of trade secrets. 212 00:10:41.279 --> 00:10:44.120 So how you handle a cyber incident and the evidence 213 00:10:44.159 --> 00:10:47.799 you collect can have really serious legal consequences down the line. 214 00:10:47.799 --> 00:10:51.879 Precisely, evidence collection and preservation must adhere to establish legal 215 00:10:51.919 --> 00:10:55.080 standards to be admissible in court. This involves maintaining a 216 00:10:55.159 --> 00:10:56.799 queer chain of custody. 217 00:10:56.480 --> 00:10:59.399 Chain of custody, proving who had the evidence. 218 00:10:59.039 --> 00:11:02.679 When exactly, ensuring the integrity of the data through techniques 219 00:11:02.720 --> 00:11:06.559 like hashing, and using forensically sound methods for acquisition. You 220 00:11:06.600 --> 00:11:07.960 can't just copy paste files. 221 00:11:08.000 --> 00:11:10.200 This is clearly a lot more involved than just, you know, 222 00:11:10.360 --> 00:11:12.440 running an anti virus scan and calling it a day. 223 00:11:12.679 --> 00:11:15.840 It certainly is. And just for a bit of historical context, 224 00:11:16.080 --> 00:11:19.120 the field of digital forensics really began to take shape 225 00:11:19.120 --> 00:11:21.879 within law enforcement back in the mid nineteen eighties as 226 00:11:21.879 --> 00:11:25.960 computers became more integral to criminal activity. The eighties, Wow, yeah, 227 00:11:26.120 --> 00:11:29.559 agencies like the FBI established specialized units such as the 228 00:11:29.559 --> 00:11:32.080 Computer Analysis and Response Team or. 229 00:11:32.080 --> 00:11:35.840 CART the FBI CART, so they were early pioneers in 230 00:11:35.879 --> 00:11:36.399 this field. 231 00:11:36.440 --> 00:11:40.279 Indeed, and the book highlights a really pivotal early case, 232 00:11:40.679 --> 00:11:44.200 the intrusion into the Lawrence Berkeley National Laboratory by a 233 00:11:44.240 --> 00:11:47.679 hacker named Marcus Hess. Okay, this activity might have gone 234 00:11:47.799 --> 00:11:50.440 unnoticed were it not for the work of Clifford's Stole. 235 00:11:51.480 --> 00:11:55.360 He devised this clever method to track the intruder his efforts, 236 00:11:55.360 --> 00:11:57.559 which he read about in his book The Cuckoo's Egg. 237 00:11:57.720 --> 00:11:59.399 The Cuckoo's Egg, I've heard of it, Yeah. 238 00:11:59.279 --> 00:12:02.159 It's a classic. It not only led to the hacker's 239 00:12:02.240 --> 00:12:06.559 prosecution for espionage, but also really underscored the critical importance 240 00:12:06.600 --> 00:12:10.559 of digital forensics expertise in our connected world even back then. 241 00:12:10.679 --> 00:12:13.320 That sounds like a fascinating story and still relevant today. 242 00:12:13.639 --> 00:12:15.840 It's amazing to see how much the feel has evolved 243 00:12:15.879 --> 00:12:17.039 since Stoles times. 244 00:12:16.840 --> 00:12:20.159 And it has evolved dramatically. Today we have highly specialized 245 00:12:20.159 --> 00:12:23.639 tools and methodologies for acquiring and analyzing digital evidence from 246 00:12:23.679 --> 00:12:27.360 a huge multitude of sources. Speaking of which, let's maybe 247 00:12:27.399 --> 00:12:30.039 delve into some of those key areas of evidence. A 248 00:12:30.080 --> 00:12:34.120 fundamental concept in digital forensics is the distinction between volatile 249 00:12:34.159 --> 00:12:35.600 and non volatile data. 250 00:12:36.120 --> 00:12:38.440 Volatile versus non volatile. Break that down for. 251 00:12:38.440 --> 00:12:42.799 Us, sure, volatile data is temporary information. It exists only 252 00:12:42.840 --> 00:12:45.360 while a system is powered on, and it's lost when 253 00:12:45.360 --> 00:12:47.879 the power is turned off. Think of the data held 254 00:12:47.919 --> 00:12:51.000 in a computer's random access memory or RAM. 255 00:12:51.240 --> 00:12:52.320 Stuff in RAM, got it. 256 00:12:52.799 --> 00:12:55.679 Non Vogal data, on the other hand, is persistent. It 257 00:12:55.720 --> 00:12:58.480 remains stored even when the system is powered down, So 258 00:12:58.559 --> 00:13:00.679 like the data on a hard drive or a solid 259 00:13:00.720 --> 00:13:02.039 state drive SSD. 260 00:13:02.279 --> 00:13:05.480 Okay. So if you're responding to a live incident, capturing 261 00:13:05.480 --> 00:13:10.440 that volatile memory the RAM quickly is crucial because it 262 00:13:10.519 --> 00:13:14.000 might contain fleeting evidence that just disappears the moment the 263 00:13:14.039 --> 00:13:16.200 machine is shut down or rebooted exactly. 264 00:13:16.240 --> 00:13:18.759 That's often priority number one. Now, let's talk about specific 265 00:13:18.879 --> 00:13:21.600 types of digital evidence, maybe starting with network evidence. 266 00:13:21.639 --> 00:13:22.440 Network evidence, ok. 267 00:13:22.559 --> 00:13:25.200 Our book emphasizes that network traffic can provide a wealth 268 00:13:25.200 --> 00:13:28.080 of information for reconstructing a security incident. 269 00:13:28.279 --> 00:13:31.480 Network traffic that sounds like an overwhelming amount of data. 270 00:13:31.519 --> 00:13:33.000 Where do you even begin to look? 271 00:13:33.159 --> 00:13:36.480 Yeah, it can be. Key starting points usually include firewall and. 272 00:13:36.480 --> 00:13:38.799 Proxy logs firewall and proxy logs. 273 00:13:39.039 --> 00:13:42.720 These logs can provide valuable insights into the initial stages 274 00:13:42.759 --> 00:13:46.919 of an attack, showing which internal systems communicated with external 275 00:13:47.039 --> 00:13:51.279 potentially malicious websites or IP addresses. They can also help 276 00:13:51.320 --> 00:13:55.200 identify command and control or C two traffic. 277 00:13:55.360 --> 00:13:58.159 C two that's a communication back to the attacker, right. 278 00:13:58.279 --> 00:14:02.440 The communication channel between an infected system and the attacker's infrastructure. 279 00:14:03.000 --> 00:14:05.639 Think of firewall and proxy logs as kind of the 280 00:14:05.679 --> 00:14:08.120 digital equivalent of border patrol logs. 281 00:14:08.200 --> 00:14:10.200 Okay, so they give you a picture of what's coming 282 00:14:10.200 --> 00:14:12.559 in and going out of your network perimeter precisely. 283 00:14:12.759 --> 00:14:16.519 Then there's NetFlow NetFlow. While firewall and proxy logs primarily 284 00:14:16.600 --> 00:14:20.759 focus on traffic crossing the network perimeter, NetFlow provides visibility 285 00:14:20.759 --> 00:14:24.320 into internal network traffic what the book calls east west. 286 00:14:24.039 --> 00:14:26.559 Traffic east west, so communication within the. 287 00:14:26.519 --> 00:14:30.200 Network exactly, Yeah, showing how systems inside the network are 288 00:14:30.200 --> 00:14:33.440 communicating with each other. This can be invaluable for detecting 289 00:14:33.480 --> 00:14:34.240 lateral movement. 290 00:14:34.440 --> 00:14:36.919 Lateral movement like an attacker who got in one place 291 00:14:37.399 --> 00:14:40.639 and is now trying to spread sideways to other machines inside. 292 00:14:40.759 --> 00:14:44.360 That's it exactly. NetFlow helps you track those internal maneuvers, 293 00:14:44.759 --> 00:14:48.240 and for a much much deeper level of analysis, there's 294 00:14:48.360 --> 00:14:49.080 packet capture. 295 00:14:49.120 --> 00:14:51.240 Packet capture grabbing the actual data. 296 00:14:51.799 --> 00:14:54.919 Tools like TCP dump on Linux and raw cap or 297 00:14:54.919 --> 00:14:57.759 wind pee cap on Windows allow you to capture the 298 00:14:57.879 --> 00:15:00.879 actual data packets being transmitted cross the network. 299 00:15:00.919 --> 00:15:01.200 Wow. 300 00:15:01.279 --> 00:15:04.159 You can even apply filters to these captures to focus 301 00:15:04.159 --> 00:15:08.000 on specific types of traffic, like communication within known malicious 302 00:15:08.039 --> 00:15:11.279 IP address or specific protocols, so you're not just drowning 303 00:15:11.279 --> 00:15:11.960 in data. 304 00:15:12.120 --> 00:15:15.039 Capturing the raw network data that's like recording every single 305 00:15:15.080 --> 00:15:18.559 digital conversation happening on your network must be huge files. 306 00:15:18.720 --> 00:15:22.159 They can be enormous, yes, and analyzing these massive amounts 307 00:15:22.159 --> 00:15:25.600 of data requires specialized tools. Wire Shark is a very 308 00:15:25.639 --> 00:15:29.639 widely used GUI based tool for both capturing and analyzing 309 00:15:29.639 --> 00:15:31.000 network traffic in detail. 310 00:15:31.039 --> 00:15:32.440 Wire Shark, Yeah, I heard of that one. 311 00:15:32.519 --> 00:15:35.440 It allows you to inspect individual packets, follow the flow 312 00:15:35.480 --> 00:15:39.039 of communication between systems, filter based on a huge range 313 00:15:39.039 --> 00:15:41.840 of criteria. The book highlights its use for both live 314 00:15:41.879 --> 00:15:44.799 capture and in depth post capture analysis, so you can. 315 00:15:44.679 --> 00:15:47.000 Watch traffic live or dig through recordings later. 316 00:15:47.399 --> 00:15:50.519 Right. For example, you can filter to see only HTTP 317 00:15:50.679 --> 00:15:54.159 traffic and then examine the specific web pages or urs 318 00:15:54.200 --> 00:15:55.120 that were accessed. 319 00:15:55.320 --> 00:15:59.159 Wire Shark sounds incredibly powerful, like a microscope for network data. 320 00:15:59.240 --> 00:16:03.600 It really is, and for analyzing very large packet captures offline, 321 00:16:03.639 --> 00:16:07.279 there are tools like arkhim arkim Yeah. The book shows 322 00:16:07.320 --> 00:16:10.159 how you can load a captured file into arkham and 323 00:16:10.159 --> 00:16:14.080 then efficiently examine things like HDVP sessions and the specific 324 00:16:14.080 --> 00:16:17.240 web addresses that were visited. Wire Shark also has handy 325 00:16:17.240 --> 00:16:20.360 features like display filters to zero in on relevant traffic 326 00:16:20.399 --> 00:16:23.720 and coloring rules to visually highlight different types of packets, 327 00:16:23.879 --> 00:16:26.399 which makes the analysis process a bit more manageable. 328 00:16:26.440 --> 00:16:29.559 S galuring rules that sounds helpful for spotting patterns it 329 00:16:29.559 --> 00:16:30.440 can be, and. 330 00:16:30.480 --> 00:16:34.159 For detecting more subtle malicious activity, like an infected system 331 00:16:34.200 --> 00:16:38.200 periodically beaconing back to a command and control server by 332 00:16:38.320 --> 00:16:41.759 quiet check In beconing right, the book introduces Rata. Rita 333 00:16:41.840 --> 00:16:45.639 uses behavioral analysis to identify these recurring patterns in network 334 00:16:45.639 --> 00:16:48.480 traffic that might otherwise get lost in the noise. Beconing 335 00:16:48.679 --> 00:16:51.879 like that regular quiet signal that an infected machine is 336 00:16:51.879 --> 00:16:55.200 still under the attacker's control. ARIDA helps you pick up 337 00:16:55.200 --> 00:16:56.320 on those faint signals. 338 00:16:57.240 --> 00:17:00.440 Very cool that's right. Okay. So now let's shift our 339 00:17:00.480 --> 00:17:04.359 focus from the network to individual computers and discuss host 340 00:17:04.440 --> 00:17:05.599 based evidence. 341 00:17:05.720 --> 00:17:07.599 Okay, evidence on the actual machines. 342 00:17:07.640 --> 00:17:10.279 As we touched on earlier, a critical first step in 343 00:17:10.359 --> 00:17:14.519 many investigations is acquiring the volatile memory, grabbing. 344 00:17:14.119 --> 00:17:16.839 That ram before the power goes off. What are the 345 00:17:16.839 --> 00:17:20.039 go to tools for that? You mentioned volatile data earlier, right. 346 00:17:20.359 --> 00:17:23.680 The book mentions win p mem as a tool specifically 347 00:17:23.720 --> 00:17:27.559 designed for acquiring a memory image from Windows systems. It 348 00:17:27.599 --> 00:17:30.480 creates a raw bit for big copy of the system's 349 00:17:30.480 --> 00:17:31.519 physical memory. 350 00:17:31.279 --> 00:17:33.240 The snapshot of the live memory. 351 00:17:32.880 --> 00:17:36.599 Exactly, which can then be analyzed offline using specialized memory 352 00:17:36.640 --> 00:17:39.599 forensics tools like volatility, which is another powerful tool. 353 00:17:39.759 --> 00:17:42.240 So you take that memory snapshot and analyze it later 354 00:17:42.319 --> 00:17:44.079 for clues that might not be present on the hard 355 00:17:44.160 --> 00:17:44.799 drive at all. 356 00:17:44.720 --> 00:17:50.119 Correct things like running processes, network connections, passwords potentially gotcha. 357 00:17:50.799 --> 00:17:54.640 What about acquiring the persistent data, the stuff stored on 358 00:17:54.640 --> 00:17:58.160 the computer's storage devices, the hard drives or SSDs. 359 00:17:58.599 --> 00:18:01.680 For acquiring non volatile evidence, there are tools like silar 360 00:18:02.000 --> 00:18:04.960 SLR is designed to efficiently collect log files and other 361 00:18:05.000 --> 00:18:06.440 protected files from a system. 362 00:18:06.720 --> 00:18:08.799 SILR for logs and protected stuff. 363 00:18:08.960 --> 00:18:12.839 Yeah, and another powerful tool is KPE. That's the Kinetic 364 00:18:12.960 --> 00:18:18.039 Artifact Parser and Extractor. KP allows for highly targeted collection 365 00:18:18.079 --> 00:18:22.119 of specific types of evidence based on predefined configurations or targets. 366 00:18:22.519 --> 00:18:25.559 This is much more efficient than just grabbing absolutely everything. 367 00:18:25.920 --> 00:18:28.759 Targeted collection focusing on the most likely sources of evidence. 368 00:18:28.759 --> 00:18:30.599 That saves a lot of time and I guess storage 369 00:18:30.599 --> 00:18:31.119 space too. 370 00:18:31.359 --> 00:18:34.720 Exactly. Then there's the crucial concept of forensic imaging. 371 00:18:34.920 --> 00:18:36.960 Imaging making a copy of the drive. 372 00:18:36.880 --> 00:18:39.680 Right, creating a complete bit for bit copy of a 373 00:18:39.720 --> 00:18:43.880 storage device. The book distinguishes between physical images, which capture 374 00:18:43.920 --> 00:18:48.000 the entire drive, including unallocated space where deleted files might linger, 375 00:18:48.319 --> 00:18:52.839 and logical images, which capture only specific partitions or files. 376 00:18:52.839 --> 00:18:55.279 Physical versus logical, which is better. 377 00:18:55.160 --> 00:18:59.119 Well for traditional hard disk drives HDDs, physical images are 378 00:18:59.119 --> 00:19:02.640 generally preferred because they preserve everything, potentially allowing for the 379 00:19:02.680 --> 00:19:06.240 recovery of deleted data. Okay, However, the book points out 380 00:19:06.319 --> 00:19:10.319 that solid state drives SSDs present unique challenges. Why is 381 00:19:10.359 --> 00:19:14.200 that because of a process called trim. Trim is designed 382 00:19:14.200 --> 00:19:18.279 to improve SSD performance, but it can securely erase deleted 383 00:19:18.319 --> 00:19:22.440 data pretty quickly, making recovery much more difficult, sometimes impossible. 384 00:19:22.640 --> 00:19:26.200 Ah So SSDs can make the job of recovering deleted 385 00:19:26.240 --> 00:19:29.599 files way more challenging for forensic investigators. 386 00:19:30.119 --> 00:19:33.000 That's often the case. Yeah. For creating these forensic images, 387 00:19:33.359 --> 00:19:36.799 tools like FTK emitter are widely used. FTK imager it 388 00:19:36.839 --> 00:19:41.319 can create forensically sound images, meaning it calculates cryptographic hashes 389 00:19:41.400 --> 00:19:44.119 like digital fingerprints of the original drive and the image 390 00:19:44.119 --> 00:19:47.000 file to ensure the integrity of the copy, proof that 391 00:19:47.039 --> 00:19:48.000 it hasn't been tampered with. 392 00:19:48.160 --> 00:19:50.680 Hashes right verifying the copy is exact, and. 393 00:19:50.640 --> 00:19:54.559 The book also emphasizes the critical importance of using right blockers. 394 00:19:54.720 --> 00:19:55.960 Right blockers these. 395 00:19:55.759 --> 00:19:59.480 Are hardware or sometimes software tools that prevent any accidental 396 00:19:59.480 --> 00:20:03.000 modific case of the original evidence drive during the imaging process. 397 00:20:03.559 --> 00:20:06.400 They ensure you don't accidentally change the evidence you're collecting. 398 00:20:06.559 --> 00:20:10.759 Right blockers absolutely essential for preserving the integrity of the 399 00:20:10.759 --> 00:20:14.279 evidence and making sure it's admissible in court. Makes sense. 400 00:20:14.720 --> 00:20:18.480 What if you can't take a system offline to create 401 00:20:18.480 --> 00:20:21.160