Identifying the 'Root' Causes of Propagation in Submitted Incident ReportsReturn to TOC

No ratings

Presented at FIRST 2014 by

Adam Shostack

Thomas Millar

Samuel Perl

Incident response is most obviously about incidents, but looking deeply at root causes has helped improve safety in many fields. We wanted to see if current incident reports could yield interesting root cause information? Such information would obviously be less complete than (say) a finished national transportation and safety board report, but could we extract it at all? Incident reports are notoriously of inconsistent quality, hard to aggregate, and complex to analyze for useful conclusions. Further complicating the problem, IR teams are often given incident reports from others over whom the IR team has no authority to dictate reporting requirements. We set out to determine if we could use incident reports submitted by others to assess the successful rates of various malware propagation vectors. Our approach applied a consistent taxonomy for malware propagation to a sample of incident reports. We will discuss key areas where the taxonomy worked and where we encountered problems. We found that for our selected sample, using some important assumptions, we were able to identify a reasonably accurate propagation vector (root cause) for over 70% of the reports with compromises. We will also discuss results showing that some of the same threat vectors were particularly problematic to many different reporters. We will talk about how conditions in the data were favorable or unfavorable to our efforts and what implications this may have on our ability to apply this method to other incident reports.