A Basic Guide to Advanced Incident Response

My talk from Tech Talk Live on building an intelligence driven threat intelligence capability.

Transcript

1. A
   Basic Guide
   to
   Advanced Incident
   Response
   

   View Slide

2. Hi, I’m Scott
   

   View Slide

3. SOC Analyst
   &
   Global Threat Analyst
   @
   Symantec
   

   View Slide

4. Security Consultant
   @
   Mandiant*
   * Acquired by FireEye
   

   View Slide

5. SOC Technical Lead
   &
   Focused Ops Team Deputy
   @
   ManTech International
   

   View Slide

6. Senior Intelligence
   Specialist
   @
   Vigilant*
   * Acquired by Deloitte
   

   View Slide

7. Bad Guy Catcher
   @
   GitHub
   

   View Slide

8. View Slide

9. What I do all Day
   - Identify and respond to Security
   Incidents
   - Collaborate with 3rd parties to
   respond to their incidents
   - Build tools to assist those above
   

   View Slide

10. Questions?
    I’m not done, just feel free
    to ask anything any time
    

    View Slide

11. I should warn you:
    !
    I always wanted
    to be a Spy
    I blame watching too much James Bond as a kid…
    

    View Slide

12. Intelligence Driven
    Incident Response
    

    View Slide

13. Intelligence Cycle
    

    View Slide

14. Intelligence Cycle
    

    View Slide

15. Incident response Process
    Preparation
    Recovery Lessons Learned
    Eradication
    Containment
    Identification
    Then…
    

    View Slide

16. Utilization
    &
    Feedback
    Analysis
    Processing
    Dissemination
    Collection
    Requirements
    Intelligence
    Cycle
    

    View Slide

17. F3EAD
    Find
    Analyze Disseminate
    Exploit
    Finish
    Fix
    While…
    

    View Slide

18. Observe
    Act Orient
    Decide
    OODA
    Loop
    

    View Slide

19. Intel To Collect
    

    View Slide

20. Indicators
    - IP addresses
    - URLs & Domains
    - Malware
    - Hashes (Absolute & Fuzzy)
    - Capabilities (What it does, how it talks)
    - Certificates, Email addresses, User Agent
    Strings, etc
    

    View Slide

21. Events
    

    View Slide

22. Incidents
    Groups of malicious events become…
    

    View Slide

23. Campaigns
    Groups of incidents become…
    

    View Slide

24. Wikis for Great Justice
    - Wikis are great for dynamically
    structured data
    - Makes collaboration Easy
    - I’ve shared threat intel and incident
    templates (Linked at the End)
    - The Price is right…
    

    View Slide

25. Developing
    Intelligence
    

    View Slide

26. Online Services
    Malicious IP Lists
    IPVoid, URLVoid, & MyWOT
    URLQuery & Wepawet
    Virus Total & Malwr
    Shodan
    CentralOps, Robtext, & Ip2location
    

    View Slide

27. Vendor Info
    - Vendor Blogs, Reports & podcasts Often
    have piles of data and indicators
    - Verizon’s Data Breach Investigations
    report is a yearly favorite
    - Look for resources from companies like
    Mandiant/FiReEye, Dell SecureWorks,
    AlienVault, and Crowdstrike
    Just watch out… they’re trying to sell you something…
    

    View Slide

28. Make Friends
    

    View Slide

29. Work Chat...
    

    View Slide

30. Personal Chat...
    

    View Slide

31. Developing Your Own Intel
    - Think about What is
    important to determine
    who might attack and then
    decide how it could happen
    - Go “hunting”
    - Listen to your Users
    - Review & Iterate on your
    Own Incidents
    

    View Slide

32. Building
    Intelligence
    Driven Incident
    Response
    

    View Slide

33. Get Management Buy In
    

    View Slide

34. Network Forensics
    Full packet capture, flow monitoring,
    & intrusion detection systems…
    

    View Slide

35. System Forensics:
    OR Alive
    Disk forensics & memory forensics…
    

    View Slide

36. If it isn’t measurable
    it didn’t happen
    

    View Slide

37. If you didn’t write it
    down it didn’t happen
    

    View Slide

38. Trust your Gut
    

    View Slide

39. Collaboration is key
    Internally & Externally
    Tactically & Strategically
    

    View Slide

40. Every Incident Response
    Starts a
    Vulnerability Assessment
    Every Vulnerability Assessment
    Starts An
    Incident Response
    For one iteration… most of the time…
    

    View Slide

41. Every Incident Response
    Starts a
    Vulnerability Assessment
    Every Vulnerability Assessment
    Starts An
    Incident Response
    For one iteration… most of the time…
    

    View Slide

42. Moscow Rules #8
    Once: Accident
    Twice: Coincidence
    Three: Enemy Action
    

    View Slide

43. Slow is smooth
    smooth is fast
    Fast is Lethal
    

    View Slide

44. The IR Tools
    You Need
    At A Price
    You’ll ❤️
    

    View Slide

45. GRR
    

    View Slide

46. Moloch
    Moloch
    

    View Slide

47. Suricata
    

    View Slide

48. - MIG is OpSec's platform
    for investigative surgery
    of remote endpoints.
    - Platform Agnostic
    - By Mozilla (The Firefox
    people)
    - MIDAS is a framework for
    developing a Mac
    Intrusion Detection
    Analysis System
    - By Etsy (yes, that Etsy) &
    Facebook (Yes, also that
    Facebook)
    Mig
    Word to the Wise: These are platforms, not products…
    MIDAS
    

    View Slide

49. Yara
    

    View Slide

50. Volitility
    The Volatility Framework is a
    completely open collection of
    tools, implemented in Python […],
    for the extraction of digital
    artifacts from volatile memory
    (RAM) samples.
    

    View Slide

51. Cuckoo Sandbox
    

    View Slide

52. LogStash
    

    View Slide

53. OSSIM
    

    View Slide

54. +
    New Player: MozDef
    

    View Slide

55. View Slide

56. $0
    GRR Mandiant MIR
    Cuckoo Sandbox ThreatGrid
    LogStash Splunk
    MozDef/OSSIM ArcSight
    MIDAS/MiG Carbon Black
    

    View Slide

57. sed/grep/jq etc.
    Free, Scalable, Automatable, & Chainable
    Command Line is your Friend
    

    View Slide

58. cat *.json | jq '.[] |
    if .action == "user.login"
    then "\(.actor_ip), \
    (.actor)" else "" end' | sort
    | uniq | sed -e 's/"//g' >
    userlogin-ip-to-user.csv
    

    View Slide

59. python, ruby, etc
    - Log Parsing and
    Manipulation
    - Automating tasks
    - Modifying and Extending
    tools
    - Building tools that simply
    don’t exist
    

    View Slide

60. Conclusion…
    -Intelligence Driven Incident
    Response is the new Normal
    -Open Source is making $$$ less
    important than Intel
    -Collaboration is Key
    -When its time to perform the time
    to prepare is past
    

    View Slide

61. Thanks
    

    View Slide

62. Resources
    - Links: http://git.io/v8hDCw
    - Blog: sroberts.github.io
    - GitHub for Ed: education.github.com
    - Projects: github.com/sroberts
    - Email: sroberts@github.com
    - Twitter: @sroberts
    

    View Slide