Unit 5: Incident Response, Monitoring, Malicious Activity, and Security Governance - Subjective Questions

Incident Response (IR) is the structured methodology an organization follows to detect, respond to, and recover from cybersecurity incidents while minimizing damage and recovery time.

The NIST Incident Response Lifecycle consists of four phases:

• Preparation: Establishing and training an incident response team, developing policies, and deploying tools (e.g., SIEM, forensic kits). This phase also includes hardening systems to prevent incidents.
• Detection and Analysis: Identifying that an incident has occurred through alerts, logs, and indicators of compromise (IoCs), then analyzing scope, impact, and severity.
• Containment, Eradication, and Recovery:
  • Containment limits the spread (short-term and long-term containment).
  • Eradication removes the root cause (malware, compromised accounts).
  • Recovery restores systems to normal operation and validates functionality.
• Post-Incident Activity: Conducting a lessons-learned review to improve future response, update documentation, and strengthen defenses.

A well-defined IR process reduces downtime, limits data loss, and ensures regulatory compliance.

Digital Forensics is the scientific process of identifying, collecting, preserving, analyzing, and presenting digital evidence in a manner that is legally admissible.

Key Principles for Preserving Evidence Integrity:

• Legal Hold: A directive to preserve all relevant data when litigation or investigation is anticipated, preventing deletion or alteration.
• Chain of Custody: Documenting every person who handled the evidence, along with the time, date, and purpose, ensuring the evidence can be traced and trusted.
• Acquisition: Creating a bit-by-bit forensic image of the original media rather than working on the original. Analysis is done on copies.
• Preservation: Using write blockers to prevent accidental modification of source media.
• Hashing / Integrity Verification: Computing cryptographic hashes (e.g., SHA-256, MD5) of the original and the image. Matching hashes prove the copy is identical and unaltered.
• Order of Volatility: Collecting the most volatile data first (CPU registers, RAM, network state) before less volatile data (disk, archives).
• Reporting: Producing a clear, reproducible report of findings.

Following these principles ensures evidence is admissible in court and resistant to challenges.

Investigations rely on multiple data sources to reconstruct events and identify root causes:

• Log Data:
  • Firewall Logs: Show allowed/blocked traffic and connection attempts.
  • Application Logs: Record events generated by specific software.
  • Endpoint Logs: Capture activity on individual hosts (process creation, logins).
  • OS-specific Security Logs: Windows Event Logs, Linux syslog, authentication records.
  • IPS/IDS Logs: Record detected intrusion attempts.
  • Network Logs: Switch, router, and access point activity.
• Vulnerability Scans: Identify known weaknesses that may have been exploited.
• Automated Reports: Generated by security tools summarizing posture and events.
• Dashboards: Provide real-time visualization of security metrics.
• Packet Captures (PCAP): Full network traffic captures for deep analysis.
• Metadata: Data about data (file timestamps, email headers, geolocation).
• NetFlow/Flow Data: Summarized traffic flow records showing source, destination, and volume.

Importance: Correlating multiple data sources improves accuracy, reduces false positives, and provides a complete timeline of the incident.

Alerting and Monitoring Tools continuously observe systems and networks to detect anomalies, generate alerts, and support rapid response.

SIEM (Security Information and Event Management):

• Aggregates and correlates log data from across the enterprise.
• Performs real-time analysis, generates alerts, and supports forensic investigation.
• Enables centralized dashboards, reporting, and compliance auditing.

SNMP (Simple Network Management Protocol):

• Used to monitor and manage network devices (routers, switches, servers).
• SNMP traps send unsolicited alerts when thresholds are crossed.
• SNMPv3 adds authentication and encryption for security.

NetFlow:

• Collects metadata about network traffic flows (source/destination IP, ports, bytes).
• Useful for detecting anomalies, bandwidth usage patterns, and data exfiltration.

Key Monitoring Activities:

• Log Aggregation: Centralizing logs for correlation.
• Alerting: Notifying analysts of suspicious events.
• Scanning: Periodic vulnerability and asset discovery.
• Reporting & Archiving: Retaining data for compliance and trend analysis.
• Alert Tuning: Reducing false positives and alert fatigue.

Together these tools provide visibility, early detection, and actionable intelligence.

Malware Attack Indicators are observable signs suggesting malicious software is present on a system.

Common Indicators by Malware Type:

• Ransomware: Files suddenly encrypted, ransom notes, inaccessible data, unusual file extension changes.
• Trojan: Unexpected programs running, backdoor connections, disguised legitimate-looking software.
• Worm: Rapid self-propagation across the network, excessive network traffic, high resource consumption.
• Spyware: Unauthorized data collection, keylogging, degraded performance.
• Rootkit: Hidden processes/files, inability of tools to detect certain activity, kernel-level anomalies.
• Bloatware/Adware: Excessive pop-ups, redirected browser traffic.
• Keylogger: Captured keystrokes, suspicious outbound data.
• Logic Bomb: Malicious code triggering on a specific date or condition.
• Botnet (Zombie): Device participating in coordinated attacks, beaconing to command-and-control (C2) servers.

General Indicators of Compromise (IoCs):

• Unusual outbound traffic and beaconing.
• Unexpected changes to registry/startup items.
• Account lockouts or privilege escalation.
• High CPU/memory usage without cause.

Recognizing these indicators enables early detection and containment before significant damage occurs.

Physical Attack Indicators suggest an adversary is attempting to compromise hardware or facilities:

• Brute Force (Physical): Forced entry, tampered locks, broken cabinets.
• RFID Cloning: Unauthorized access badges, duplicated credentials.
• Environmental Tampering: Disabled sensors, cut cameras, HVAC manipulation.
• Device Theft: Missing laptops, servers, or storage media.

Network Attack Indicators suggest malicious activity on the network:

• Distributed Denial-of-Service (DDoS): Massive traffic spikes, service unavailability, resource exhaustion. May be amplified or reflected.
• DNS Attacks: DNS poisoning, domain hijacking, unexpected DNS resolutions.
• Wireless Attacks: Rogue access points, evil twins, deauthentication floods.
• On-Path (Man-in-the-Middle) Attacks: Intercepted/modified traffic, certificate warnings.
• Credential Replay: Reused session tokens or captured credentials.
• Malicious Code: Payloads delivered over the network.

Common Observable Signs:

• Unusual traffic volume or patterns.
• Connections to known-malicious IPs.
• Repeated failed authentication attempts.
• Unexpected port/protocol usage.

Monitoring both physical and network layers ensures defense in depth.

Application Attack Indicators reveal attempts to exploit software vulnerabilities.

Injection Attacks:

• SQL Injection (SQLi): Malicious SQL in input fields; indicators include unusual database errors, unexpected query results, and unauthorized data access.
• Cross-Site Scripting (XSS): Injected scripts; indicators include unexpected script execution and session hijacking.
• LDAP/Command Injection: Abnormal directory queries or OS command execution.

Buffer Overflow:

• Occurs when data exceeds allocated memory, overwriting adjacent memory.
• Indicators: application crashes, unexpected code execution, segmentation faults, privilege escalation.

Replay Attacks:

• Captured valid data (e.g., session tokens) is retransmitted to impersonate a user.
• Indicators: duplicate transactions, reused session identifiers, timestamp anomalies.

Other Application Indicators:

• Privilege Escalation: A low-privilege account gaining admin rights.
• Forgery (CSRF): Unauthorized actions performed on behalf of a user.
• Directory Traversal: Access to files outside the web root (e.g., ../../etc/passwd).
• Resource Exhaustion: Memory/CPU spikes from malicious requests.

Mitigations include: input validation, parameterized queries, secure coding, and web application firewalls (WAFs).

These three documents form a hierarchy that guides organizational security:

Policies:

• Define the what and why.
• Examples: Acceptable Use Policy (AUP), Information Security Policy, Business Continuity, Incident Response, SDLC, Change Management policies.

Standards:

• Define the mandatory requirements to meet policy.
• Examples: Password standards, encryption standards (AES-256), access control standards.

Procedures:

• Define the how — detailed, repeatable steps.
• Examples: Onboarding/offboarding procedures, change management procedure, playbooks.

Guidelines (related): Recommended, non-mandatory best practices.

Together they ensure consistency, compliance, and accountability.

Change Management is the structured process for requesting, reviewing, approving, implementing, and documenting changes to IT systems to minimize risk and avoid disruption.

Key Business Process Components:

• Approval Process: Changes must be formally reviewed and authorized, often by a Change Advisory Board (CAB).
• Ownership: A clearly defined owner is accountable for the change.
• Stakeholders: All affected parties are identified and consulted.
• Impact Analysis: Assessing potential effects on systems, security, and operations.
• Test Results: Validating changes in a test environment before production.
• Backout Plan: A documented rollback procedure if the change fails.
• Maintenance Window: A scheduled, low-impact time for implementation.
• Standard Operating Procedures (SOPs): Repeatable, documented steps.

Technical Implications:

• Allow/Deny Lists updates.
• Restricted Activities and downtime considerations.
• Service/Application Restarts and dependency management.
• Legacy Applications that may be fragile.

Documentation:

• Updating diagrams, policies, and version control.

Benefits: Reduces unplanned outages, maintains security posture, provides an audit trail, and ensures accountability.

Automation refers to using technology to perform individual tasks without human intervention. Orchestration coordinates multiple automated tasks and tools into a unified workflow. Together they are often implemented through SOAR (Security Orchestration, Automation, and Response) platforms.

Common Use Cases:

• User/Resource Provisioning: Automated onboarding/offboarding.
• Guardrails: Automatically enforcing security policies.
• Security Group Management: Dynamic firewall/access rule updates.
• Ticket Creation and Escalation: Automated incident workflows.
• Continuous Integration/Testing: Automated code security scans.
• API Integrations: Connecting disparate tools.

Benefits:

• Efficiency & Time Savings: Faster response to incidents.
• Consistency / Enforced Baselines: Reduces human error.
• Scalability: Handles large workloads easily.
• Reaction Time: Near-instant response to threats.
• Workforce Multiplier: Frees analysts for complex tasks.
• Reduced Reaction Time and standardized outcomes.

Drawbacks / Considerations:

• Complexity: Difficult to design and maintain.
• Cost: Initial investment in tools and training.
• Single Point of Failure: A flawed automation can propagate errors rapidly.
• Technical Debt and Ongoing Supportability requirements.

Conclusion: When properly implemented, automation and orchestration significantly strengthen security operations, but require careful governance.

Order of Volatility refers to the sequence in which digital evidence should be collected based on how quickly it is lost or changed. Volatile data disappears when power is lost or systems change state, so it must be captured first.

Order of Volatility (Most to Least Volatile):

1. CPU Registers and Cache: Extremely transient, lost in microseconds.
2. RAM (Memory): Running processes, encryption keys, network connections — lost on shutdown.
3. Network State / Routing Tables / ARP Cache: Active connections, temporary.
4. Running Processes: Live process information.
5. Temporary Files / Swap / Page Files: Transient storage.
6. Disk / Hard Drive Data: Relatively persistent.
7. Remote Logging / Monitoring Data: Stored elsewhere, stable.
8. Physical Configuration / Archival Media (backups): Most persistent.

Importance:

• Prevents Evidence Loss: Capturing volatile data first ensures critical artifacts (like malware in memory or encryption keys) are not lost.
• Maximizes Evidence Value: Memory may contain data never written to disk.
• Legal Admissibility: Demonstrates methodical, defensible collection.

Following the order of volatility ensures the most fragile and valuable evidence is preserved before it vanishes.

Both IDS and IPS monitor network/host traffic for malicious activity, but differ in how they respond.

Detection Methods (both):

• Signature-Based: Matches known attack patterns; effective but misses zero-days.
• Anomaly-Based: Flags deviations from a normal baseline; detects unknown threats but higher false positives.
• Heuristic/Behavioral: Uses rules/behavior to identify suspicious activity.

Roles in Monitoring:

• IDS provides visibility and alerting for analyst investigation.
• IPS provides active defense, stopping attacks automatically.

Many modern deployments combine both as IDPS, balancing detection and prevention.

Log Aggregation is the process of collecting log data from many disparate sources (firewalls, servers, endpoints, applications) into a centralized repository. Correlation is the analysis of these aggregated logs to identify relationships and patterns across events.

Importance:

• Centralized Visibility: A single pane of glass across the enterprise.
• Event Correlation: Links seemingly unrelated events into a meaningful incident (e.g., a failed login + privilege escalation + data transfer).
• Faster Investigation: Analysts don't need to query each system individually.
• Compliance: Retains logs for audits and regulatory requirements.
• Timeline Reconstruction: Builds a chronological view of an attack.

Reducing Alert Fatigue:

• Alert Tuning: Refining rules to suppress known false positives.
• Prioritization: Correlation assigns severity so analysts focus on critical alerts.
• Deduplication: Combining repeated alerts into a single incident.
• Automation: SOAR integration auto-handles routine alerts.
• Thresholds: Only triggering alerts when meaningful patterns emerge.

Alert fatigue occurs when analysts are overwhelmed by too many (often false) alerts, causing them to miss real threats. Effective correlation and tuning ensure analysts respond to high-value, actionable alerts.

This phase is the core operational response to an incident, aimed at stopping damage, removing the threat, and restoring normal operations.

1. Containment:
The goal is to limit the spread and impact of the incident.

• Short-Term Containment: Immediate actions such as isolating affected hosts, disconnecting from the network, or disabling compromised accounts.
• Long-Term Containment: Temporary fixes allowing continued operation while a permanent solution is prepared (e.g., applying patches, rebuilding backups).
• Segmentation: Using VLANs, firewalls, and network isolation to quarantine affected systems.
• Considerations: Preserve evidence before isolating; avoid tipping off the attacker; balance business continuity.

2. Eradication:
The goal is to completely remove the root cause.

• Remove malware, delete malicious accounts, and close exploited vulnerabilities.
• Patch systems and update signatures.
• Rebuild compromised systems from known-good images.
• Validate that all traces of the threat are removed to prevent re-infection.

3. Recovery:
The goal is to restore systems to normal, secure operation.

• Restore data from clean backups.
• Rebuild and reconnect systems in a controlled manner.
• Monitor closely for signs of recurring compromise.
• Validate functionality and confirm the environment is secure before returning to production.

Supporting Concepts:

• Root Cause Analysis (RCA): Determining the underlying cause to prevent recurrence.
• Threat Hunting: Proactively searching for residual threats.
• Communication: Keeping stakeholders informed throughout.

Conclusion: A disciplined approach to this phase minimizes damage, prevents reinfection, and restores trust in affected systems.

Playbooks:

• High-level, strategic documents outlining the overall response to a specific type of incident (e.g., ransomware, phishing, data breach).
• Define what steps to take, decision points, roles, and escalation paths.
• Often integrated into SOAR platforms for automated workflows.

Runbooks:

• Detailed, operational, step-by-step instructions for performing specific tasks.
• Define how to execute each action (e.g., how to isolate a host, how to reset credentials).
• More granular and technical than playbooks.

Relationship: A playbook describes the strategy; runbooks provide the tactical steps that the playbook references.

Tabletop Exercises:

• Discussion-based simulations where the team walks through a hypothetical scenario.
• Low-cost, no impact on production systems.
• Test decision-making, communication, and the IR plan without executing real actions.

Related Testing Methods:

• Simulations: More realistic, may involve phishing tests or injected scenarios.
• Walkthroughs: Review of plans step by step.
• Full-scale Drills: Live exercises testing actual response capabilities.

Benefits:

• Improve readiness and coordination.
• Identify gaps in the IR plan.
• Build muscle memory so the team responds effectively under pressure.

Governance Policies provide the framework for managing security consistently across the organization.

Key Policies:

• Acceptable Use Policy (AUP): Defines appropriate use of organizational systems, data, and internet resources by employees.
• Information Security Policy: Overarching policy defining how information is protected (confidentiality, integrity, availability).
• Business Continuity Policy: Ensures critical functions continue during disruptions.
• Disaster Recovery Policy: Procedures for restoring IT systems after a catastrophic event.
• Incident Response Policy: Defines how incidents are detected, reported, and handled.
• Software Development Lifecycle (SDLC) Policy: Governs secure development practices.
• Change Management Policy: Controls how changes are introduced to systems.

Governance Structures:

• Boards: Provide oversight and strategic direction.
• Committees: Specialized groups (e.g., risk committee, security committee).
• Government Entities: Regulatory bodies imposing requirements.
• Centralized vs. Decentralized Governance: Centralized provides uniform control; decentralized allows flexibility per business unit.

Roles and Responsibilities:

• Data Owners, Data Controllers, Data Processors, Data Custodians/Stewards each have defined responsibilities for data protection.

Importance: Clear policies ensure accountability, legal compliance, risk reduction, and a consistent security culture.

Root Cause Analysis (RCA) is a systematic process of identifying the fundamental underlying cause of an incident, rather than merely addressing its symptoms.

RCA Process:

1. Define the Problem: Clearly state what happened and its impact.
2. Collect Data: Gather logs, evidence, and timeline information.
3. Identify Causal Factors: Determine the sequence of events leading to the incident.
4. Determine Root Cause: Use techniques like the 5 Whys or Fishbone (Ishikawa) diagrams to drill down to the true cause.
5. Recommend and Implement Solutions: Address the root cause to prevent recurrence.

Example (5 Whys):

• Why was data breached? A server was compromised.
• Why was it compromised? An unpatched vulnerability was exploited.
• Why was it unpatched? The patch management process missed it.
• Why was it missed? No automated patch tracking existed.
• Why? Budget/process gap — root cause.

Why RCA is Critical (Post-Incident):

• Prevents Recurrence: Fixing root causes stops repeat incidents.
• Improves Processes: Reveals systemic weaknesses.
• Informs Lessons Learned: Feeds back into the IR lifecycle.
• Reduces Future Risk and Cost: Addressing the source is cheaper than repeated firefighting.

RCA transforms an incident into an opportunity for organizational improvement.

These are three primary approaches to detecting malicious activity.

1. Signature-Based Detection:

• Compares observed activity against a database of known attack signatures (patterns).
• Pros: High accuracy and low false positives for known threats; fast.
• Cons: Cannot detect zero-day or novel attacks; requires constant signature updates.
• Example: Antivirus matching a known malware hash.

2. Anomaly-Based Detection:

• Establishes a baseline of normal behavior and flags deviations.
• Pros: Can detect unknown/zero-day attacks.
• Cons: Higher false positive rate; requires a well-defined baseline; sensitive to legitimate changes.
• Example: Flagging a user downloading 10x their normal data volume.

3. Behavior-Based Detection:

• Monitors the actions and behavior of entities to identify malicious intent regardless of signature.
• Pros: Detects advanced threats and insider activity; adaptive.
• Cons: Complex; requires analysis and tuning.
• Example: Detecting ransomware by observing mass file-encryption behavior.

Comparison Summary:

Modern systems combine all three for layered, effective detection.

Indicators of Compromise (IoCs) are forensic artifacts or pieces of evidence that indicate a system has been breached or malicious activity has occurred.

Common IoCs:

• Network-Based:
  • Connections to known-malicious IPs or domains.
  • Unusual outbound traffic / beaconing to C2 servers.
  • Unexpected port and protocol usage.
  • DNS anomalies and data exfiltration patterns.
• Host-Based:
  • Unknown processes or services running.
  • Changes to the registry or startup items.
  • Unauthorized file modifications or new files.
  • Suspicious scheduled tasks.
• Account-Based:
  • Account lockouts, impossible travel logins, privilege escalation.
  • Logins at unusual times or from unusual locations.
• File-Based:
  • Known malicious file hashes (MD5/SHA-256).
  • Suspicious file names/extensions.

How IoCs are Used:

• Threat Detection: SIEM and endpoint tools match IoCs against observed activity to generate alerts.
• Threat Intelligence Sharing: IoCs are shared via feeds (e.g., STIX/TAXII) to improve collective defense.
• Threat Hunting: Analysts proactively search environments for IoCs to find undetected compromises.
• Incident Scoping: IoCs help determine the extent of a breach.

Note: IoCs are reactive (evidence of past/current compromise), whereas IoAs (Indicators of Attack) focus on attacker intent and behavior in progress.

The Digital Forensics Process:

1. Identification:

• Recognize potential sources of evidence (devices, logs, media).
• Determine the scope and nature of the incident.
• Issue a legal hold to preserve relevant data.

2. Collection / Acquisition:

• Capture evidence following the order of volatility (RAM before disk).
• Use write blockers to prevent modification.
• Create forensic images (bit-by-bit copies).
• Establish and document the chain of custody.

3. Preservation:

• Store original evidence securely.
• Compute cryptographic hashes (SHA-256) to verify integrity.
• Work only on verified copies.

4. Analysis / Examination:

• Recover deleted files, examine metadata, timelines, and artifacts.
• Identify IoCs, malware, and attacker actions.
• Correlate evidence across sources.

5. Documentation:

• Record every action taken, maintaining reproducibility.
• Preserve the chain of custody throughout.

6. Presentation / Reporting:

• Produce a clear, factual report admissible in legal proceedings.
• Present findings to stakeholders or in court.

How Automation and Orchestration Enhance Forensics & IR:

• Automated Evidence Collection: Scripts and SOAR tools can snapshot memory, gather logs, and preserve artifacts instantly across many hosts.
• Faster Triage: Automated enrichment correlates IoCs with threat intelligence.
• Consistency: Enforced, repeatable procedures reduce human error and preserve integrity.
• Ticketing and Escalation: Automatically generate incident tickets and notify responders.
• Containment Actions: Orchestration can auto-isolate hosts or disable accounts.
• Scalability: Handles large-scale incidents affecting hundreds of systems.

Considerations: Automation must be carefully governed to avoid destroying volatile evidence or triggering false containment. A balance of automated efficiency and human oversight yields the best outcomes.

Conclusion: A rigorous forensics process ensures legally defensible evidence, while automation and orchestration dramatically improve the speed, consistency, and scale of modern incident response.