Digital Forensics, Incident Response, and Cloud Computing · Digital Forensics, Incident Response,...

DigitalForensics,IncidentResponse,and

CloudComputingTroyLarson

Azure|MSRCMicrosoftCorp.

Forensics, Response, Cloud Computing

•MSRC|Azure• Securityincidentresponseinvestigations.• Forensics@Microsoft.• Compromise|Intrusion|Breach.• Forensicsandincidentresponseinvestigationsforthecloud.

What is cloud computing?

• Insider’sviewofcloudcomputing:• Technologyoverview.• Policy.• ForensicsandIncidentresponse.• Practices.• Challenges.• Opportunities.

What is cloud computing?

•Automated datacenter,wheremachines are-• Deployedbymachine.•Managedbymachine.•Monitoredbymachine.• Forservices.• Fortenants.

Cloud Compute

Vacation Resources

Azure Technical Overview

•Collectionofautomateddatacenters.•Primaryresources:• Compute.• Storage.• Network.

•Datacenters.•Clusters.• Nodes(blades).

•Computenode(hostserver).

•Virtualmachine,fromthehost.

Memory

GPA1 GPA2

VHD1 VHD2

•Thepersistent virtualharddrive.

•Thevirtualharddrive.• Tothehost,afile.• Tothevirtualmachine,aphysicaldisk.• Partitionedandformattedtocreatevolumesandfilesystems.• Canbeorganizedlikephysicalharddrives:• Singledisks.• Dynamicvolumes—volumesspanningvirtualdisks.• RAID.

•Virtualmachinememory.

PageFileonVHD

•Virtualmachine,fromwithin.

Memory

C:\ D:\

•Differentviewpoints.•Onthehostsideofthehypervisor:• Memoryisguestphysicaladdressspace.• Disksarefiles.

•Ontheguestsideofthehypervisor:• Memoryconsistsofvirtualandphysicaladdressspace.• Diskappearasphysicalandlogicalmedia.

Policy

•Cloudadministratorsandsecurityteams:• ExtremelylimitedvisibilityintowhatishappeningwithtenantVMs.

• Tenantadministratorsandsecurityteams:• CompletevisibilityintowhatishappeningontheirVMs.• NovisibilityintowhatishappeningonothertenantVMsorhostorinfrastructure.

• Securityresponsibilityfollowsownership.

Policy

•Security.• SharedSecurityModel:• Management.• Ownership.

Policy

•Securityincident.

TOR TOR TOR TOR TOR

Network

EvidenceAcquisitionof

Cloud-BasedMachines

•Virtualmachines,acquisition.

Host/VM•Memory• AsGPA.• Assavedstatefile(s).

•Media• Asfiles.• Asblobs.

• Network• Fromvirtualswitch.

Guest/VM•Memory• Live.

•Media• Asphysicalorlogicaldisks.• Asblobs.

• Network• Live.

Host/VM• Runningorstopped.• Statecanbefrozen.*• Nocollectionartifacts.*• Consistentmemoryanddiskimages.*

Guest/VM• Running.• Stateisdynamic.• Collectionartifacts.• Inconsistentmemoryanddiskimages.

GPAVHD

VHDC:\

Memory

Host/VM

•Cloudprovider.

Guest/VM

• Tenant.

•Tenantevidenceacquisition:• Standardremotecollectionproceduresandtoolsshouldworkforacquiringcloud-basedVMs.*•Blobstorageofvirtualdisksallowsforquickacquisitionorsnapshotsofvirtualdisks.• Equivalentto,orbetterthan,currententerpriseremoteevidencecollectioncapability.*

•Cloudinfrastructure.• Consistsofhundredsofthousandsofphysicalmachines.• HugeamountsofRAM.*• Hugeamountsofdiskstorage.*• Noveldiskstoragetechnologies.*• Underextremelyheavyload.*

• Canexceedthecapabilityofcurrentforensicstoolsandpractices.

•Cloudinfrastructure.• Networkisnotastandardcorporatenetwork.• Nodomainauthentication.• Segmented.• Firewalled.

• Standardenterpriseremoteevidencetoolsandproceduresoftenwillnotwork.

ForensicAnalysisOf

Cloud-BasedMachines

•Cloudmachines:• Usestandardoperatingsystems.• Common,wellknownfilesystems,filetypes,structures,andstrings.• Amenabletostandardanalyticaltoolsandprocedures.• Subjecttocompromise,breach,andothercommonsport.

•Securityincidentresponseandstateless virtualmachines.• PAASdesignedtobestateless.• Scalabilityandfaulttolerance.• Persistentdatagoestostorage.• Newinstancestartsclean.

• Remediationbycommandline.•Whatisthepointofdoingforensicsorotherin-depthsecurityincidentinvestigation?

•Cloud(virtual)machineadvantages.• Fromhost:• Fullyconsistentmemorydumps.• Fullyconsistentdrive(volume)images.• Statefiles.

• Bytenant:• Fullyconsistentdriveimagesfromstorage.*

• Issuesofscaleandscalability.• Cloudinfrastructureisvast.• Cloudenvironmentismorevast.• Virtualentitiescanbedynamic,andendpointsephemeral.

• Tenantdeploymentscanbevastanddynamic,too.

•Cloud-readyincidentresponseandforensics:•Mustbeabletoworkatscale.•Mustbescalable—monitoring,triage,loganalysis,forensics.*

•Problem:• DF/IRisdependentonsubjectmatterexpertise.• Subjectmatterexpertsdonotscalewell.*

Researchtopics.

•Whatisnormal?*

Theanalyticalopportunitiesofscale.

*JesseKornblumhttps://digital-forensics.sans.org/summit-archives/2010/eu-digital-forensics-incident-response-summit-jesse-kornblum-computer-forensic-tool-panel.pdf

•Cloudmachines|“Roles”|n identicalinstances.• Role instances:• xyz-service-01_of_200• xyz-service-02_of_200• xyz-service-03_of_200• ...• xyz-service-56_of_200

•RoleInstances:• SameOSVHD.• Samehardwareanddrivers.• Sameconfigurationsettings.• Sameapplicationsandservices.• Sameprocessesandcommandlines.• Sameevents.

•Processescreationevent(SecEventID4688):• Newprocessnameandpath.• Parentprocess.• Commandline.• Accountthatlaunchestheprocess.

•Whatprocessesruninexactlythesameway,onallroleinstances?

•Role-specific,eventbaselines:• Identical4688events,acrossallinstances(perrole),showwhatruns,how,bywhataccount.• Whatisnormalforanyinstanceofthatrole.• Usage:Compareindividualtotheherd.• Detectionandmonitoring.• Liveanalysisandtriage(e.g.,Kansa).• Memoryforensics.• Diskforensics.

•Role-specific,eventbaselines:• Signaltonoise:non-identical4688events.• Uniqueforaroleinstance.• Anomalous,mayindicatesecurityissue.• Usage:Whatstandsoutagainsttheherd.• Detectionandmonitoring.• Hunting.

•Whatotherherdbehaviorcanindicatenormalorhighlightanomalies?• Taskschedulerandserviceevents.• Objectaccessevents?• Logon,sourceIPaddress?• Errorandfailureevents?• IPFIX?• Prefetch?• Amache.hve?

Questions?

Digital Forensics, Incident Response, and Cloud Computing · Digital Forensics, Incident Response,...

Documents

Incident Response and Forensics in AWS - SecTor · Incident Response and Forensics in AWS ... •Overview of AWS Security Model ... effective Digital Forensics and Incident Response

proactive n reactive forensics - RedIRIS · QWhat is Digital Forensics? – Incident response – Computer Forensic Investigations ... Forensics Response ... proactive_n_reactive_forensics.ppt

Establishing an Incident Response Plan...Computer Forensics. AGENDA • Incident Response Landscape • Incident Response Considerations • NIST Framework • Elements of an IR Plan

Cyber Incident Response & Digital Forensics Lecture

Trends in Digital Forensics & Incident Response · Several Incident Response or Incident Handling frameworks One popular approach has 6 steps Steps 1 & 2 are Preparation and Identification

Memory Forensics for Incident Response

Intro to Incident Response and Forensics

PACB One-Day Cybersecurity Workshop · PACB One-Day Cybersecurity Workshop INCIDENT RESPONSE AND ... No standard incident response form Missing Forensics Support ... Computer Forensics

Digital forensics and incident response€¦ · Digital forensics is often part of an incident responder’sjob Law enforcements Computer Emergency Response Teams (CERTs) In Norway:

A Common Process Model for Incident Response and Computer Forensics · A Common Process Model for Incident Response and Computer Forensics Felix C. Freiling Laboratory for Dependable

The SANS Survey of Digital Forensics and Incident Response · PDF fileThe SANS Survey of Digital Forensics and Incident Response ... lack of specialized tools, ... Program 1 The SANS

Fusing digital forensics, electronic discovery and incident response

INCIDENT RESPONSEINCIDENT RESPONSE CONTAINMENT REMEDIATION Data recovery Find root cause Devise incident response plan Forensics Assess impact Security audits Detect malware After

Memory forensics and incident response

Incident Response: Network Forensics

Security Engineer - Incident Response and Digital Forensics · 2020-05-13 · Security Engineer – Incident Response and Digital Forensics SpearTip - Mission Statement Blend cutting-edge

The SANS Survey of Digital Forensics and Incident Response

Distributed forensics and incident response in the enterprise · 2017-01-27 · Distributed forensics and incident response in the enterprise M.I. Cohen*, D. Bilby, G. Caronni Google

Incident Response and Digital Forensics – Denver Chapter of ISACA

SANS Digital Forensics and Incident Response Poster 2012