Evidence collection handling

Reporting and documenting

Investigative techniques

Digital forensics

Operational

Criminal

Civil

Regulatory

Electronic discovery (eDicsovery)

Intrusion detection and prevention

Intrusion detection and prevention

Continuous monitoring

Egress monitoring

Asset inventory

Configuration management

Physical assets

Virtual assets

Cloud assets

Applications

Need-to-know/least privilege

Separation of duties and responsibilities

Monitor special privileges

Job rotation

Information life cycle

Service-level agreements

Media management

Hardware and software asset management

Detection

Response

Mitigation

Reporting

Recovery

Remediation

Lessons learned

Firewalls

Intrusion detection and prevention systems

Whitelisting/Blacklisting

Third-party security services

Sandboxing

Honeypots/Honeynets

Anti-malware

Backup storage strategies (e.g., offsite storage, electronic vaulting, tape rotating) a Recovery site strategies

Multiple processing sites (e.g., operationally redundant systems)

System resilience, high availability, quality of service, and fault tolerance

Response

Personnel

Communications

Assessment

Restoration

Training and awareness

Read through

Walkthrough

Simulation

Parallel

Full interruption

Perimeter

Internal

Critical business resilience maintain continuity

Provide routine maintenance of various assets

Protect assets from damage

Maintain controls over user access to business-critical systems

Provide checks and balances on various accounts, especially privileged accounts, to ensure they are legitimate business needs

Change, configuration and problem management of IT services

Security-related programs, such as user allocation and help desk programs

Focus on reporting and service continuous improvement practices

due care due care

due diligence due deligence

using these solutions most effectively while also ensuring that privileged accounts are carefully

service account

The account that executes the script

the provisioning of usersuser configuration

managing their access across multiple systems managing their access across multiple systems

native access control systemslocal access control systems

need to know

Least privilege least privilege

Privileged account

Normal or restricted user account

Definition: Breaking a key task into different parts, with each part being performed by a different person

Purpose

reason

System administrator

operator

security administrator

Help/Service Desk Personnel

general user

Licensing, suitability and background checks

Access should not be granted in the following situations (e.g., based on IDS and firewall logs, access to an IP should be blocked immediately, but is not; adjusting the clock or deleting logs, etc.)

Account ValidationAccount Validation

Job rotationsJob rotations

Two-person operation

compulsory leave

■ Determine the impact the information has on the mission of the organization.

■ Understand the replacement cost of the information (if it can be replaced)Understand the replacement cost of the information (if it can be replaced).

■ Determine who in the organization or outside of it has a need for the information and under what circumstances the information should be released.Determine who in the organization or outside of it has a need for the information and under what circumstances the information should be released.

■ Know when the information is inaccurate or no longer needed and should be destroyed.Know when the information is inaccurate or no longer needed and should be destroyed.

Classification is concerned primarily with access

categorization is primarily concerned with impact.

standardize the defense baselines to standardize the baselines

■ Reduce storage costs

■ Save only relevant information to speed up searching and indexing

■Litigation holds and electronic disclosures are less likely to encounter errors, pre-decisions or negotiated information

An SLA is a simple document that describes the level of service a customer receives from a supplier, showing service measurements, remediation, or penalties if agreement requirements are not met.

If the SLA is not met due to the customer's fault, there should be no penalty

SLA

OLA (Operational Level Agreements

Make sure both parties understand the requirements

Ensure that the agreement has not been misinterpreted intentionally or unintentionally

Different levels have different prices

starting point for negotiation

Service elements

Management elements

SLAs kept updated

The supplier will have to pay the customer any third party costs resulting from the breach of warranty

statistics

Service Availability

Defect RatesDefect Rate

Technical Quality

Security

99 percent availability (which allows for over 7 hours of unplanned downtime per month

99.9 percent (43.8 minutes per month)

99.99percent (4.4 minutes per month).

■ Component sets are subject to configuration management

■ How components are named

■How components enter and leave control sets

■How components under CM are allowed to change.

■How different versions of components under CM are available

■Under what circumstances can each of them be used?

■How CM tools enable and enhance configuration management

1. Brand

2.Model

3. M A C addresses

4. Serial number

5. Operating system or firmware version

6. Location

7. BIOS and other hardware-related passwords

8. Assigned IP address if applicable

9. Labels or barcodes for organizational asset management

1. Software name

2. Software vendor (and reseller if appropriate)

3. Password or activation code (note if there are hardware keys)

4. Type of license and for what version

5.Number of licenses

6. License expiration

7. License portability

8. Organizational software librarian or asset manager

9. Organizational contact for installed software

10. Upgrade, full or limited license

Security experts can quickly find and mitigate vulnerabilities related to hardware type and version

Knowing the type and location of hardware in the network can reduce the effort of identifying affected devices

Unauthorized devices on the network can be discovered through scanning

Logging and tracking configuration changes provides assurance of network integrity and availability

Regular checks to ensure unauthorized changes

risk-based decision making

Importance of patches

Will it affect the business?

Schedule updates

Notify users before deployment

Update at night or on weekends

Backup server before deployment

Some invisible problems may arise

Patch management is about knowing both about security issues and patch releases

Be aware of security issues and software updates relevant to their environment

It is recommended that a dedicated person and team be responsible for alerting administrators and users of security issues or app updates.

1. Patch life cycle (patch cycle) guides the normal application of patches and system updates

2. Job planning to handle critical security and functional patches and updates

system criticality

Processed data

environmental complexity

Availability requirements

Available resources

Source (soucre) verification

Integrity check

The test environment is as close as possible to the production environment

You can use subsystems of the production system as a test environment

Demonstrate patch success with specific milestones and acceptance criteria

Allow updates in closed change system

Tool selection

Tool type

Complete in time

Controllable and predictable

What systems need to be patched for any known vulnerabilities or bugs?

Is the system updated with real patches?

Asset and host management

Management tools

System discovery tools

Patch management solutions are team-based technologies that provide policy and operational solutions based on collaborative efforts to address the unique requirements of an organization.

Help the organization know all its parts

Identify these weaknesses

System defects

Configuration error

Strategy error

conducted at the system console or through the use of agents on servers and workstations throughout the

identifying missing security updates on servers

identify unauthorized software or services that might indicate a compromised system

Configuration error found

Directs all incident-related activities and directs security personnel to a predefined and pre-authorized path to resolution.

Describe the activities undertaken in relation to the roles and responsibilities of the parties involved in the incident.

border control

Security operations focuses on ensuring technology can operate effectively and continuously monitors its effectiveness

ID/IPS

firewall

Email security servicesSecure email services

fundamental to successful security operations reporting is the foundation of security operations

Intended audience for the report

reporting frequency

identify and respond to suspected security-related events in real time or near real time. Used to identify and respond to suspected security-related events in real time or near real time.

Network-based intrusion systems

host-based intrusion systems

IDS

IPS

Signature- or Pattern-Matching systems pattern matching (or signature analysis)

Protocol Anomaly-Based systemsAnomaly-based intrusion detection system

Statistical-Anomaly-Based systems Intrusion detection system based on statistical anomalies

False-positives

False-negatives

installed on individual hosts, on systems deployed on individual hosts and systems

Unified Threat Management (UTM) security gateway

continual updatesContinuously update the virus database

monitored to ensure they are still active and effective

automatic scanning for new media and email attachments. Deploy automatic scanning policy for media and email attachments

Scanning should be scheduled and accomplished on a regular basis. Scanning should be scheduled and accomplished on a regular basis.

One disadvantage of system logs is that they provide a view into that single system. The disadvantage of system logs is that they can only provide a single system perspective and cannot provide logs and information about related events involving multiple systems.

provide a common platform for log collection, collation, and analysis in real time Provide a common platform for log collection, collation, and real-time analysis.

provide reports on historical events using log information from multiple sources

Log management systems are similarLog management systems are similar

maintain a disciplined practice of log storage and archiving maintain strict log storage and archiving discipline

Modern reporting tools can also be used to transform security event information into useful business intelligence. Modern reporting tools can also be used to transform security event information into useful business intelligence.

■ The need to preserve forensic evidence for possible legal action. to preserve forensic evidence with legal action

■ The availability of services the affected component provides. Provide the affected component to maintain the availability of services

■ The potential damage that leaving the affected component in place may cause. Replace the affected component to avoid the potential damage that may cause.

■ The time required for the containment strategy to be effective.

■ The resources required to contain the affected component.

lead to further attack

■ Does the media or an organizations external affairs group need to be involved? Does the media or an organizations external affairs group need to be involved?

■ Does the organizations legal team need to be involved in the review? Does the organization's legal team need to be involved in the review?

■ At what point does notification of the incident rise to the line management, At what point does the incident rise to the line management, and middle managers are notified.

middle management, senior management, the board of directors, or the stakeholders? Senior management? director? A board of directors?

■ What confidentiality requirements are necessary to protect the incident information? What are the confidentiality requirements to protect the incident information?

■ What methods are used for the reporting? If email is attacked, how does that impact the reporting and notification process? What methods are used for the reporting? How are reporting and notification procedures initiated if an email system is compromised? Mobile phone, solidification, emergency contact?

Eradication is the process of removing the threat. Eradication is the process of removing the threat. (If a system is infected with a virus and is no longer functioning properly, a thorough disinfection will eradicate the problem.)

work backwards to determine what allowed the event to happen in the first place. Work backwards to determine what allowed the event to happen in the first place. Work backwards to determine the cause of the event, working forward layer by layer until the root cause is discovered.

R CA can quickly cross boundaries between technical, cultural, and organizational.RCA can quickly cross boundaries between technical, cultural, and organizational boundaries.

Remediation Repair

incident management

problem management

security audit

security reviewsecurity review

The outcome of the security audit and review processThe output of the security audit and review process should be listed as items and issues to be addressed in an organized manner

computer forensics, digital forensics, and network forensics to electronic data discovery, cyber forensics, and forensic computing.

Based on methodological, verifiable and auditable procedures and protocols

Identifying Evidence Identifying Evidence

Collecting or Acquiring EvidenceCollecting or Acquiring Evidence

Examining or Analyzing the EvidenceExamining or Analyzing the Evidence

Presentation of FindingsPresentation of Evidence

1. Identify the scene determine the scene,

2. Protect the environment protect the environment,

3. Identify evidence and potential sources of evidenceIdentify evidence and potential sources of evidence,

4. Collect evidenceCollect evidence,

5. Minimize the degree of contamination

physical environment

virtual environment

dynamic evidence

motivation

Chance

Way

Usage MO

Rocca's Law of Exchange

When dealing with digital evidence, all common forensic and procedural principles must be applied.

The act of grabbing evidence cannot change the evidence.

When it is necessary for a person to access original digital evidence, that person needs to be trained for this purpose.

All activities related to the seizure, access, storage or transmission of digital evidence must be fully documented, retained and available for review and inspection.

When digital evidence is in someone's possession that person must be responsible for all activities related to the digital evidence.

Any agency responsible for capturing, accessing, storing and transmitting digital evidence is responsible for compliance with these principles.

■ Minimize handling/corruption of original data.

■ Account for any changes and keep detailed logs of your actions.

■ Comply with the five rules of evidence.

■ Do not exceed your knowledge.

■ Follow your local security policy and obtain written permission.

■ Capture as accurate an image of the system as possible.

■ Be prepared to testify.

■ Ensure your actions are repeatable.

■ Work fast.

■ Proceed from volatile to persistent evidence.

■ Do not run any programs on the affected system.

virtual team

Dedicated team

Hybrid mode team

Outsourcing resources

general framework

definition

step

Evidence chain of custody

Interview

evidence admissible in court

Evidence collection principles

Australian Computer Forensics General Guidelines

Evidence analysis method

need

computer crime

first responder

Three elements of criminal investigation

Egress Monitoring Egress Monitoring

Continuous monitoring systems are designed to meet organizational needs;

Implement ongoing monitoring systems and protect critical agency facilities;

For details, please pay attention to the "Collecting Security Data" section in "Chapter 6 Security Assessment and Testing"

Providers commit several small crimes in the hope that they combined into a larger crime will not attract attention

Changes to existing data

Capture passwords sent between computers

The attacker does not want others to know his real address, so he changes the IP address of the packet so that it points to another address.

Look through other people's trash cans to find discarded documents, information, and other valuable items that could be used against that person or company.

A passive attack, the tools used to eavesdrop on communications can be wireless phone scanners, radio receivers, microphone receivers, voice recorders, network sniffers, etc.

This is when someone purchases a domain name with the goal of using a similar domain name to harm a company or to extort money.

Soft-copy media

hard-copy media

Media containing sensitive or confidential information should be encrypted

data should be protected through the use of encryption to mitigate a compromise.

product software

Original copies and installed versions of system and application

question

Solution suggestions

Backups and archives are two different types of methods used to store information

Recovery from backups

Cloud storage

Virtual storage

Records and Information Management Program (RIM)

Protect hard copy records

Residual data should be cleared carefully

Simple delete or format

Software removal tools

remanence

Degaussing

physical destruction

Malicious activity on the part of malware and malicious users can cause the loss of a significant amount of information.

Interruptions in service can also be extremely disruptive to normal business operations

Theft is also a common threat.

protections on key systems as well as provide appropriate procedures

Based on Network Intrusion Detection System (NIDS)

Host-Based Intrusion Detection System (HIDS)

Based on application IDS

Feature based IDS

Rule-based IDS

Based on anomaly IDS

If the IDS detects an intrusion

Early versions of IDS were integrated with firewalls to guide the firewall to implement proposed rules for allowed traffic.

Normal business may be affected during the process of activating rules

IDS basic components

Determine who can receive information

Determine the type of alert received and the urgency of the information

IDS is one of the security technologies widely adopted by enterprises.

Effective IDS Management

A list of email addresses or IP addresses, etc., listed as "good" senders

A list of "bad" senders

I don't know who you are and your email skips extra steps before I accept it"

Greylisting tells the sending email server to quickly resend new emails.

Non-profit organizations

Track the operations and sources of Internet spam

Provide real-time and effective spam protection for the Internet

A set of technologies aimed at preventing the leakage of sensitive corporate information

Locate and catalog sensitive information stored across the enterprise;

Monitor and control the movement of sensitive information across the enterprise;

Monitor and control the movement of sensitive information from end-user systems;

Organizations often fail to realize the type and location of the information they process. When purchasing a DLP solution, they must first understand the types of sensitive data and data flows between systems and from systems to users;

Classifications can include attribute categories, such as privacy data, financial data, and intellectual property;

Once the data is properly identified and categorized, a deeper analysis process helps locate primary data and critical data paths;

It is necessary to pay attention to the life cycle of enterprise data, and understanding the processing, maintenance, storage and disposal of data can reveal deeper data storage and transmission paths;

Advantages of deploying DLP

Find and identify specific file types and identify and record the location where information is stored;

Once found, DLP opens and identifies the contents of the file;

DLP uses crawler systems; crawlers

DLP solution

To monitor enterprise network data movement, DLP solutions use special network devices or built-in technologies to selectively capture and analyze network traffic;

Deep packet inspection (DPI) technology, as the core capability of DLP, DPI can read the packet payload content beyond the basic header information.

DPI technology allows DLP to detect data in transit and determine content, source and destination;

DLP has the ability to handle encrypted data (for example, with an encryption key), or to decrypt it before detection and continue to encrypt it after detection is completed;

Monitor data movement actions taken by end users on their workstations

Use Agent to complete tasks

Policy Creation and ManagementPolicy Creation and Management

Directory Services Integration

Workflow ManagementWorkflow Management

Backup and RestoreBackup and Restore

ReportingReporting

watermark

Steganography is an information hiding technology that hides large amounts of information in pictures and video files;

Information hiding includes covert channels, hiding text on Web pages, hiding visible files, and empty passwords;

Dynamic application security testing (DAST)

Acts as a decoy server to collect information about attackers or intruders operating on the system

Variants of IDS

Common tools

Software virtualization technology

Let programs and processes run in an isolated environment

Restrict access to other system files and systems

A replacement for traditional signature-based antivirus

Malware uses a variety of techniques to evade detection

Hooks

environmental checksenvironmental monitoring

Anti-Malware Testing Standards Organization (AMTSO Anti-Malware Testing Standards Organization

Windows

Android

Surviving SiteSurviving Site

Self-ServiceSelf-service

Internal Arrangement Internal Arrangement

Reciprocal Agreements/Mutual Aid Agreements Reciprocal Agreements/Mutual Aid Agreements

Dedicated Alternate Sites Dedicated Alternate Sites

Work from Home Work from home

External Suppliers External Suppliers

No Arrangement No arrangement

Cost-benefit analysis (CBA)

fully prepared

incremental backup

differential backup

Using this strategy makes the application unacceptable for downtime to impact the organization

Advantage

shortcoming

Internal Hot Site Internal Hot Site

External Hot SiteExternal Hot Site

Advantage

shortcoming

A rental facility partially equipped with some equipment but not actual computers

A cold site is a shell or empty data center without any technical facilities on the floor

Advantage

shortcoming

It is a mobile trailer or standard container equipped with appropriate telecommunications equipment and IT equipment. It can be flexibly dragged, dropped and placed at the required alternate location to provide key application services such as telephone switching functions.

advantage

shortcoming

This solution can be used if the organization has facilities across the country or the world

Have sufficient bandwidth and latency

Can be thought of as a “reciprocal agreement” within an organization

Used to share downtime risks between organizations

In the event of a disaster, each organization commits to taking on the other's data and processing tasks

question

Meet the cost-effectiveness needs of enterprises

advantage

shortcoming

trusted path

Fail-Safe

Fail-Secure Fail-Secure Property Security

Device backup

Power backup

Drives and data storage

Backup and restore system

Staffing Flexibility

the board and senior management

Includes use of BIA and risk assessment

Identify key roles and responsibilities and establish minimum requirements for the organization's business continuity testing, including baseline requirements for testing frequency, scope and results reporting

Testing strategies vary depending on the scope and risk scenarios of the organization

Address testing issues for the organization and its service providers

The testing strategy for internal systems should include the people involved when systems and data files are tested

centralized number

Help desk

Technical Operations Center

physical security personnel

Monitoring personnel

Create an emergency contact list

Assessment Team

Establish communication channels

Don’t forget about the unavailability of some services

Made up of senior managers in the organization

No need to do the initial response part

Take full responsibility for the recovery of the organization and business

Located in the command center after the incident

No need to manage daily operation and maintenance

Executives need to respond and assist in resolving issues that require their guidance

Focus on strategic responses

Crisis Management vs. Crisis Leadership

Report directly to the command center

Responsible for monitoring the disaster recovery team and developing recovery and recovery processes

Report incident status to senior management

Make decisions that support recovery

main function

Retrieve off-site records and recovery information stored off-site

Report to offsite site

Perform recovery procedures in order of priority

Communicate recovery status to command center as needed

Identify issues and report them to the management team for resolution

Establish a recovery team to support 24/7 shifts

Establish liaisons with key business users and personnel

Repair and replace equipment and necessary software to resume normal operations

Center for communication and decision-making during emergencies

In the event of a disaster, provide emergency response documentation and other resources needed to respond to the disaster

Also includes procedures for dealing with financial issues

Organizations with multiple locations will need a plan for each business site

What are the key businesses or technologies in the site?

Prepare an appropriate recovery strategy for it

who is the decision maker

Where should people go if they can't get back into the building?

The process of declaring a disaster

Backup site location

Travel options to backup sites

Workstation allocation at backup site

Hotels near backup sites\Transportation services and logistics

The problem with many plans is human resources issues

Disasters can greatly affect people

The level of support team members will be clearly defined by the nature of the disaster itself

Incorporate administrative support as part of the recovery team

In emergencies, members of the emergency contact list are contacted directly by the Responsible Management Team

Describe how the organization will contact remaining members

Establish emergency information line

Employees and their families

Contractors and business partners

Q Facility and Site Managers

Q Staff Managers (HR, IT, etc.)

Q Senior Managers; Board of Directors

Institutional investors and shareholders

insurance representatives

Suppliers and Distributors

Customers

Government Regulators and Politicians

Competitors

Unions

Communities

Industry activist groups

Internet users or bloggers

media representatives

During the disaster recovery process, each employee should be consistent in what they tell the customer or vendor about the situation

Businesses should provide all stakeholders with updated information on recovery status

Non-Incident non-incident

Incident

Severe Incident serious incident

Take photos before taking action

Negotiate with vendors to provide equipment to build or restore data centers

Know crisis management

In disaster recovery, it’s not about performing recovery but leading the organization back to normal.

Know the procedures for performing recovery

and the logistics facilities they're going to.

evacuation plan

Put part of the BCP plan into new employee training

■ Expectations for business lines and support functions to demonstrate the achievement of business continuity test objectives consistent with the BIA and risk assessment;

■ A description of the depth and breadth of testing to be accomplished;

■ The involvement of staff, technology, and facilities;

■ Expectations for testing internal and external interdependencies;

■ An evaluation of the reasonableness of assumptions used in developing the testing strategy.

BCP tested at least once a year

Test objectives can start simply and gradually increase in complexity, participation level, function, and physical location

Testing should not jeopardize normal business operations

Tests demonstrate various management and response capabilities under simulated crises, gradually adding more resources and participants

Reveal inadequacies so test procedures can be corrected

Consider deviating from test scripts to insert unexpected events, such as the loss of key individuals or services

Include sufficient amounts of all types of transactions to ensure appropriate capabilities and functionality of the restoration facility

Based on predetermined test scope and objectives

Contains test plan review process

Including the development of various test scenarios and methods

Test Plan

Set by senior management

Role responsibilities, frequency, scope and reporting results

Pay attention to the operation of the test business line

Focus on testing the continuity of technical parts

Ensure key personnel from all areas are familiar with BCP

Ensure the planned response organization's ability to recover from disasters

Meeting room contact, low cost

Simulate as real a scene as possible

Cannot affect business

Continuity planning is an ongoing process

All defined tasks must be kept current and consistent with the existing environment

There must be annual requirements

emergency management organization (EMO) emergency management organization