Digital Forensics for Cyber Defense

Frameworks to Structure Analysis

Digital Forensics for Cyber Defense - DisclaimerThe contents of this presentation are not my own

views and do not represent that of my employer.

The contents of this presentation draw upon

publicly available information and my own

perceptions in a best effort to create awareness on

the contained subject matter. Enjoy the show...

Digital Forensics for Cyber Defense - #WHOAMI.@home:~$ whoami

PeterStaarfanger

.@home:~$ uptime

13 Years+

.@home:~$ service –-status-all

[ + ] Master of Science, Information Security, Capella University, 2007

[ + ] Bachelors of Science, Computer Science, Columbus State University, 2004

[ + ] Associates of Applied Science, Criminal Justice, Columbus State University, 2000

[ + ] GXPN - GIAC Exploit Researcher and Advanced Pen Tester, 2018

[ + ] GREM - GIAC Reverse Engineering Malware, 2017

[ + ] CFSR - Certified Forensic Security Responder, 2016

[ + ] CBE - Certified Blacklight Examiner, 2016

[ + ] CMO - Certified Mobile Operator,, 2016

[ + ] ASA - Arcsight Advanced Security Analyst, 2016

[ + ] EnCE - Encase Certified Examiner, 2015

[ + ] ISSEP - Information Systems Engineering Professional, 2011

[ + ] CISSP - Certified Information Security Systems Professional, 2008

[ + ] CHFI - Certified Hacking Forensic Investigator, 2009

[ + ] CEH - Certified Ethical Hacker, 2008

[ + ] CSFA - Certified Stonegate Firewall Architect, 2012

[ + ] CCNA - Cisco Certified Network Associate, 2007 (expired)

[ + ] SECURITY+ - 2005

[ + ] NETWORK+ - 2005

[ + ] DOD Incident Handler Certified - 2005

.@home:~$ uname –a

Cyber Defense Forensic Analyst Lead

.@home~$ ls -1

Malware Risk and Mitigation Report

Mobile Technology Layered Security Model

A Malware Analysis Story

Memory Analysis for Responders

Digital First Response Blog

Exploit2Forensics

Digital Forensic Analyst as a Career

Digital Forensics for Cyber Defense Part 1 & 2 :)

Digital Forensics for Cyber Defense -Overview- Modern IT Environment

- Digital Forensics and Incident Response

- Cyber Defense Perspective

- Tactics for Digital Forensics

- Analysis Approaches

- Your Forensic Community Matters!

Modern IT Environment

Digital Forensics and Incident Response

NIST SP 800-61NIST SP 800-86

Cyber Defense PerspectiveLOCKHEED MARTIN’s “CYBER KILL CHAIN ®”

David J Bianco’s “Pyramid of Pain”

Center for Cyber Threat Intelligence and Threat Research “Diamond Model”

Cyber Defense Perspective - Know Defense Know Offense

Tactics for Digital Forensics

Network and Log Forensics

It is possible to have an environment where full network recording is recording

but it is more likely that logs are being collected.

Memory Forensics

Time is expensive and volume of data to analysis is not your friend. Memory capture can require more effort then checking collecting logs.

Cloud Forensics

If your solution is Application-As-A-Service or Platform-As-A-Service and in scope this

might be your first stop..

Firmware Forensics

This can be very technical and may require very specialized tools.

Media Forensics

Storage can be large and form factors vary. Time cost is much higher.

05

01

02 03

04

Cloud Forensics

Cloud ForensicsAll those devops tools (from HostAdvice):

Network and Log Forensics1. Know your Protocols

a. 7-Layer (OSI Model) or 4-Layer (rfc1122)

b. Know Common Ports, Know Common Protocol by Layer, Know Common

Applications

c. Understand the Network Environment and IP Addressing (rfc1918)

Network and Log Forensics2. Know your Applications and Operating Systems(OS)

a. Get an accurate Inventory of OS(es) and Applications owned by the company

b. Check by product what logs are available and what is being collected

c. Understand what normal looks like

3. Know your Tools

a. Packet Capture Tools

b. Log Collection and Analysis Tools

c. Know Common Security Products and where they operate

d. Learn a 4th Generation Programming Language!

Memory Forensics1. Know your Layers

a. RFC3227 - Guidelines for Evidence Collection and Archiving (See Order of Volatility)

b. Understand the CPU and it’s Protection Rings

c. Understand Memory Layout

d. Understand differences between Physical (Page Frames) vs Virtual Memory (Page)

e. Understand the organization of Virtual Memory

f. Understand the How the Operating Systems perform Memory Management

2. Know your Toolsa. Memory Acquisition Tools (Virtual vs Physical Devices)

b. Memory Analysis Tools (Structured and Unstructured)

c. Memory Carving Tools (Structured and Unstructured)

d. Learn a 4th Generation Programming Language!

Media ForensicsKnow your Layers and Tools!

Brian Carriar’s File System Forensic Analysis1. Acquisition Tools (Scoping!)2. Analysis Tools (Structured and

Unstructured)3. Carving Tools (Structured and

Unstructured)4. Learn a 4th Generation

Programming Language5. Understand the different

types of media/hardware in use

Firmware Forensics1. Know your Layers

a. Supply Chain Attacks and/or Bios Exploitation

b. Flash Memory on the Motherboard (Check the

vendor documentation)

c. Understand Memory Ranges assignment by OS

2. Know your toolsa. Firmware Acquisition (Physical or Logical)

b. Firmware Analysis (Hex Editors and Dissemblers!)

c. Firmware Carving Tools

Analysis Techniques1. Temporal Analysis

2. Differential Analysis

3. Anomaly Based Analysis (think lolbins!)

4. Signature Based Analysis

5. Rule Based Analysis

6. Keyword Search and Proximity Analysis

7. Static Analysis

8. Code Analysis

9. Dynamic Analysis

10.Statistical Analysis

Your Forensic Community Matters

DISCLAIMER1. FOLLOW THE LAWS OF THE COUNTRY THE EVIDENCE IS EXPECTED TO BE COLLECTED IN!

1. FOLLOW ANY ESTABLISHED RULES FOR THE COUNTRY OR COMPLIANCE FRAMEWORKS THAT ARE APPLICABLE TO THE EVIDENCE!

1. FOLLOW ESTABLISHED PRACTICES FOR FORENSICS! (ISO27037, ISO27041 thru ISO27043, ISO17025, SWGDE, PCI PFI, ISFCE, IACIS)

1. THE DAUBERT STANDARD! (NOTE THIS IS FROM THE USA)a. Whether the theory or technique employed by the expert is generally accepted in

the scientific community;b. Whether it has been subjected to peer review and publication;c. Whether it can be and has been tested;d. Whether the known or potential rate of error is acceptable; ande. Whether the research was conducted independent of the particular litigation or

dependent on an intention to provide the proposed testimony.

Digital Forensics for Cyber Defense - DiscussionThank you for your time!