National Infrastructure Security Coordination Centre Forensics for Critical

  • Slides: 24
Download presentation
National Infrastructure Security Coordination Centre Forensics for Critical Information Infrastructure Protection (CIIP) Ian Bryant

National Infrastructure Security Coordination Centre Forensics for Critical Information Infrastructure Protection (CIIP) Ian Bryant Head NISCC Research & Technology Group & MOD Permanent Representative to NISCC Crown Copyright © 2004 Working Document for Discussion ONLY 1

Forensics in CIIP • The CIIP Context • Forensics and Triage • Questions Crown

Forensics in CIIP • The CIIP Context • Forensics and Triage • Questions Crown Copyright © 2004 Working Document for Discussion ONLY 2

The CIIP Context Crown Copyright © 2004 Working Document for Discussion ONLY 3

The CIIP Context Crown Copyright © 2004 Working Document for Discussion ONLY 3

Cyber Attack • Selection of mechanisms – 1 st Order Cyber effects • Mal.

Cyber Attack • Selection of mechanisms – 1 st Order Cyber effects • Mal. Ware (Collateral) ; DDOS (Directed) – 2 nd Order Cyber effects • Collateral Physical effects of Cyber acts • Cyber Psy. Ops e. g. Threats to HLS personnel – 2 nd / 3 rd / nth Order Kinetic effects • Physical attack causing Cyber impact Crown Copyright © 2004 Working Document for Discussion ONLY 4

Threat Spectrum Monetary or Physical Damage War Terror Sabotage Disobedience Psychological Impact Crown Copyright

Threat Spectrum Monetary or Physical Damage War Terror Sabotage Disobedience Psychological Impact Crown Copyright © 2004 Working Document for Discussion ONLY 5

Incidents Reported to UNIRAS N. B. : Log scale Crown Copyright © 2004 Working

Incidents Reported to UNIRAS N. B. : Log scale Crown Copyright © 2004 Working Document for Discussion ONLY 6

The Multipartite Problem • Variety of interested parties – – – Organisations detecting an

The Multipartite Problem • Variety of interested parties – – – Organisations detecting an Incident Security Staffs Law Enforcement Technical Staffs National CIIP organisations • Dependencies – Avoiding actions of one party adversely impacting on others’ interests – Biggest challenge is to prevent Evidential contamination during Detection / Triage Crown Copyright © 2004 Working Document for Discussion ONLY 7

Communities of Interest Protective Marking Mainly Classified Others UK (NISCC) Intelligence Focus of Interest

Communities of Interest Protective Marking Mainly Classified Others UK (NISCC) Intelligence Focus of Interest Mainly Threat Defence CIP LE Mainly Unclassified CSIRT Mainly Vulnerability National Span of Interest Crown Copyright © 2004 Working Document for Discussion ONLY 8

Is this Forensics ? Frequency Ports Very High 21 (FTP), 80 (HTTP), 111 (Sun.

Is this Forensics ? Frequency Ports Very High 21 (FTP), 80 (HTTP), 111 (Sun. RPC), 139 (Net. BIOS-SSN), 1433 (MS-SQL) High 22 (ssh), 23 (telnet), 25 (smtp), 53 (domain), 137 (Net. BIOS-NS), 443 (HTTP-S), 445 (MS-DS), 515 (lpdw 0 rm), 1080 (SOCKS), 1524 (Ingreslock), 3128 (Squid), 6112 (dtspc), 8080 (HTTP-alt), 27374 (Sub. Seven) Medium 3 (compressnet), 57 (privterm), 1024 (Jade), 1214 (Grokster), 1243 (Backdoor-G), 3072 (CSDmonitor), 3389 (MSTerm. Svc), 5800 (VNC), 6588 (Analog. X), 8000 (irdmi), 8888 (ddi-tcp-1) Low 135 (epmap), 1434 (MS-SQL), 2049 (NFS), 4000 (Back. Door), 4001 (newoak), 4002 (pxc-spvr), 4003 (pxcsplr), 8081 (Black. Ice) Very Low (All others) Crown Copyright © 2004 Working Document for Discussion ONLY 9

Forensics and Triage Crown Copyright © 2004 Working Document for Discussion ONLY 10

Forensics and Triage Crown Copyright © 2004 Working Document for Discussion ONLY 10

Triage (Tr-äzh, Träzh) 1. A process for sorting injured people into groups based on

Triage (Tr-äzh, Träzh) 1. A process for sorting injured people into groups based on their need for or likely benefit from immediate medical treatment. 2. A system used to allocate a scarce commodity 3. A process in which things are ranked in terms of importance or priority Crown Copyright © 2004 Working Document for Discussion ONLY 11

Incident Triage Main Categories – Offensive Information Operations – Serious Security Breach – Serious

Incident Triage Main Categories – Offensive Information Operations – Serious Security Breach – Serious Criminal Offence – Other Electronic Attack – Other Technical Incident – Other Criminal Offence – Other Security Incident Crown Copyright © 2004 Working Document for Discussion ONLY 12

Response Profile (1) Type Offensive Information Operations Characteristics Malicious Electronic Attack (MEA) • HERF

Response Profile (1) Type Offensive Information Operations Characteristics Malicious Electronic Attack (MEA) • HERF weapons • Denial of Service (DOS) • Targeted Mal. Ware Threat Actor(s) • Hostile Power(s) • Empowered Small Agent(s) Lead National Government Forensics Requirement • 2 phase : Rapid Assessment followed by Post Event Analysis • Evidential quality not usually paramount • Rapid restoration of service Remarks Typically Military response (if permitted by Rules of Engagement (Ro. E)) Crown Copyright © 2004 Working Document for Discussion ONLY 13

Response Profile (2) Type Serious Security Breach Characteristics Compromise of: • Highly Sensitive Information

Response Profile (2) Type Serious Security Breach Characteristics Compromise of: • Highly Sensitive Information • Highly Critical Systems Threat Actor(s) • Hostile Intelligence Service(s) • Individuals Lead Security / Counter-Intelligence Staffs Forensics Requirement • 2 phase: Assessment, then Comprehensive Incident Analysis • Evidential quality will vary • Timely restoration of service Remarks Forensic requirement will vary with Attribution, as actions by Individuals may lead to a Prosecution Crown Copyright © 2004 Working Document for Discussion ONLY 14

Response Profile (3) Type Serious Criminal Offence Characteristics Typical categories • Theft • Misuse

Response Profile (3) Type Serious Criminal Offence Characteristics Typical categories • Theft • Misuse (obscene material) Threat Actor(s) • Individuals Lead Law Enforcement Forensics Requirement • 1 phase: Comprehensive Incident Analysis • Evidential quality paramount • Timely restoration of service Remarks Police and Criminal Evidence Act, and ACPO Code of Practice, govern Evidential Requirements Crown Copyright © 2004 Working Document for Discussion ONLY 15

Response Profile (4) Type Other Electronic Attack Characteristics Directed attack, or Collateral Attack with

Response Profile (4) Type Other Electronic Attack Characteristics Directed attack, or Collateral Attack with Major Impact : • DDOS • Defacement • Mal. Ware with malicious payload Threat Actor(s) • Empowered Small Agent(s) • Individual(s) Lead CSIRTs (“CERTs”) Forensics Requirement • 2 phase: Assessment, then Comprehensive Incident Analysis • Evidential quality will vary • Rapid restoration of service Remarks Forensic requirement will vary with Attribution, as if perpetrator can be identified, may lead to a Prosecution Crown Copyright © 2004 Working Document for Discussion ONLY 16

Response Profile (5) Type Other Technical Incidents Characteristics Threat Actor(s) Typically “undirected”, but of

Response Profile (5) Type Other Technical Incidents Characteristics Threat Actor(s) Typically “undirected”, but of significant impact: • Intensive Scans and Probes • Spamming • Mal. Ware without malicious payload • Individual(s) Lead CSIRTs (“CERTs”) or WARPs Forensics Requirement • Normally only Assessment required • Occasional need for Comprehensive Incident Analysis • Rapid restoration of service Forensic requirement will vary with both Novelty and Attribution: • If event is unique or unusual, Technical details of most interest • If clear perpetrator can be identified, may lead to a Prosecution Remarks Crown Copyright © 2004 Working Document for Discussion ONLY 17

Response Profile (6) Type Other Criminal Offence Characteristics Major categories • Misappropriation • Criminal

Response Profile (6) Type Other Criminal Offence Characteristics Major categories • Misappropriation • Criminal Damage Threat Actor(s) • Individuals Lead Law Enforcement Forensics Requirement • 1 phase: Comprehensive Incident Analysis • Evidential quality paramount • Timely restoration of service Remarks Police and Criminal Evidence Act, and ACPO Code of Practice, govern Evidential Requirements Crown Copyright © 2004 Working Document for Discussion ONLY 18

Response Profile (7) Type Other Security Incident Characteristics Minor Impact • Misuse (excluding obscene

Response Profile (7) Type Other Security Incident Characteristics Minor Impact • Misuse (excluding obscene material) • Failure to observe security regulations Threat Actor(s) • Individuals Lead Local Security Staffs Forensics Requirement • Not normally required • Minimal impact on service if invoked Remarks If Forensics required, will normally only be for limited Evidential quality for internal disciplinary concerns Crown Copyright © 2004 Working Document for Discussion ONLY 19

Summary So where does this lead us? Crown Copyright © 2004 Working Document for

Summary So where does this lead us? Crown Copyright © 2004 Working Document for Discussion ONLY 20

No “One Size Fits All” Solution Speed Evidential Quality Continuity of Service Crown Copyright

No “One Size Fits All” Solution Speed Evidential Quality Continuity of Service Crown Copyright © 2004 Working Document for Discussion ONLY 21

Conclusions • Widespread need for Forensic services in Information Assurance • A Triage process

Conclusions • Widespread need for Forensic services in Information Assurance • A Triage process is essential to determine speed, scope, and purpose when Forensic involvement required • Forensics activity must not become a Denial of Service (DOS) itself • Biggest challenge to Forensics is outside the control of its own community : – Prevention of Evidential contamination during Detection / Triage Crown Copyright © 2004 Working Document for Discussion ONLY 22

Questions ? Crown Copyright © 2004 Working Document for Discussion ONLY 23

Questions ? Crown Copyright © 2004 Working Document for Discussion ONLY 23

Contact Details Ian Bryant Head of Research & Technology NISCC PO Box 832, London,

Contact Details Ian Bryant Head of Research & Technology NISCC PO Box 832, London, SW 1 P 1 BG, England Telephone: Facsimile : +44 -20 -7821 -1330 x 4565 (PA) +44 -20 -7821 -1330 x 4561 (Direct) +44 -20 -7821 -1686 Internet mailto: ianb@niscc. gov. uk http: //www. niscc. gov. uk Crown Copyright © 2004 Working Document for Discussion ONLY 24

Forensics Anthropology Forensics Anthropology What is Forensics AnthropologyForensics Anthropology Forensics Anthropology What is Forensics Anthropology
Forensics and Auditing Computer Forensics Computer forensics isForensics and Auditing Computer Forensics Computer forensics is
Forensics What is Forensics Forensics Science associated withForensics What is Forensics Forensics Science associated with
Infrastructure Security Introduction to Cyber Security Infrastructure SecurityInfrastructure Security Introduction to Cyber Security Infrastructure Security
COORDINATION COMPOUNDS Chemistry of Coordination Compounds Coordination CompoundsCOORDINATION COMPOUNDS Chemistry of Coordination Compounds Coordination Compounds
WP 2 Critical National Infrastructure Raminder Ruprai SecurityWP 2 Critical National Infrastructure Raminder Ruprai Security
National Infrastructure Citizens Account National Infrastructure The VisionNational Infrastructure Citizens Account National Infrastructure The Vision
The National STEM Centre The National STEM CentreThe National STEM Centre The National STEM Centre
Network Forensics Overview Network forensics Systematic tracking ofNetwork Forensics Overview Network forensics Systematic tracking of
Forensics of Hair Analysis Hair Forensics Hair CanForensics of Hair Analysis Hair Forensics Hair Can
File Forensics File Forensics Commonly used toolscommands binwalkforemostFile Forensics File Forensics Commonly used toolscommands binwalkforemost
COEN 252 Computer Forensics Introduction to Computer ForensicsCOEN 252 Computer Forensics Introduction to Computer Forensics
Foundations of digital Forensics 1 Computer Forensics ComputerFoundations of digital Forensics 1 Computer Forensics Computer
Digital forensics Andrej Brodnik Digital Forensics Computer chapterDigital forensics Andrej Brodnik Digital Forensics Computer chapter
What is Computer Forensics Forensics The use ofWhat is Computer Forensics Forensics The use of
Highlands High School Forensics Team What is ForensicsHighlands High School Forensics Team What is Forensics
COEN 252 Computer Forensics Challenges of Network ForensicsCOEN 252 Computer Forensics Challenges of Network Forensics
NUR 430 Part 11 Forensics in Nursing ForensicsNUR 430 Part 11 Forensics in Nursing Forensics
Computer Forensics By Chris Brown Computer Forensics DefinedComputer Forensics By Chris Brown Computer Forensics Defined
1 Live Forensics Tutorial Part 1 Traditional Forensics1 Live Forensics Tutorial Part 1 Traditional Forensics
INTRODUCTION TO FORENSICS What is Forensics Law DepartmentsUnitsINTRODUCTION TO FORENSICS What is Forensics Law DepartmentsUnits
Forensics of Hair Analysis Hair Forensics One ofForensics of Hair Analysis Hair Forensics One of
Forensics of Hair Analysis Hair Forensics One ofForensics of Hair Analysis Hair Forensics One of