Investigator of Interest – Our Philosophy of Adaptive Incident Response to Turn the Tables During an InvestigationReturn to TOC

No ratings

Presented at FIRST 2014 by

Pascal Arends

“You are being watched, the attacker has a secret system —a spying program— that spies on you every hour of every day. I know, because we have seen it (multiple times).” Imagine that you are investigating a breach but the attacker keeps ahead of your investigation. You see malicious traffic on the IDS but once you investigate the machine of interest there are no more traces of the attacker, and the malicious traffic has stopped. In this presentation we will provide insight into our philosophy of adaptive incident response. Adaptive incident response requires more than simply running a technical investigation. Crucial, for example, is rapid attacker profiling and how you can use that to adjust your investigation strategy. What type of attacker is this, what do they want and what are their capabilities? The results influence your strategy: live investigation versus offline investigation, network agents versus tools that are in place, active versus passive monitoring and offline bulk analysis. In addition, we’ll discuss practical countermeasures that our investigators use to game up our investigation and keep ahead of attackers. We’ll discuss investigation platforms, communications and systems. Ultimately, Adaptive incident response is about turning the tables: once an attacker is inside, they become the defender.