Wie können Sie während einer Untersuchung vollständige und genaue Beweise sammeln?

Nation state actors are using novel new techniques to deploy threats like ransomware and coin miners at scale using several automated ways. So Defenders should have a plan to respond to such threats at lighting speed and scale. Below are a few high-level recommendations:- - Being sensible for the approach of full disk image vs quick triage collection to respond and investigate in a faster way. - Make sure your collection tools can reach all the segments of the network to avoid any last minute production network changes and delays - Use native functions and capabilities of EDR or XDR tools to live response the endpoint and get required data. - Clear and well documented process and workflows which can be followed in critical attacks.

The methods used to collect evidence can vary, but "forensically sound" data collection is the common factor. Your main objective is to never tamper with or alter digital evidence, to the best of your ability. Always work off a copy. A. Where legal process may be involved: Document a detailed chain of custody, make/model/HD size/accounts or target location in cloud as well as access levels, and authorization. Take notes as you go. Always over estimate the amount of storage needed for duplicates and a "golden copy" of data. B. Where your time or resources are restricted - pull evidence into a stable repository with a reputable Forensic toolkit. Free versions (buy training) of Zimmerman tools, FTK, or F-Response exist to make this easier.

Planning ahead is crucial in any cyber investigation. It ensures that the evidence collected is relevant, legally obtained, and useful for the investigation's objectives. Without proper planning, there's a risk of overlooking important details, violating legal parameters, or collecting data that may not be admissible in legal proceedings. Effective planning also involves understanding the technical aspects of the investigation, ensuring that digital evidence is gathered and preserved in a way that maintains its integrity and authenticity.

One needs to distinguish between a forensic investigation and incident response. Although similar, the purpose is usually quite different. Typically, incident response gravitates towards understanding the incident, to ensure effective remediation and recovery. Forensic investigation typically is used to support potential litigation. Responding to a breach by a nation state or a ransomware gang is 'incident response' and benefits from an approach at speed and scale. Forensics, for instance to deal with an insider threat, may gravitate more towards disk imaging and forensics, which is not an approach that works very well at at scale and at speed. Choose the approach (technology and processes) most fitted to the circumstances.

Keeping our portable Forensic toolkit ready and updated is vital. Ensuring the integrity of all the tools used in Incident Response phase helps to improve the admissibility of evidence, if it needs to be presented in a court of law. Another aspect is capability, competence and coverage of tools. Make sure that our armour contains all the well established tools of the trade

Planning ahead for evidence collection in an investigation is crucial. It involves not only defining objectives and scope but also understanding the legal landscape. For instance, in cases involving digital evidence, it's important to be aware of laws governing digital privacy and data protection. This might mean obtaining search warrants or subpoenas for accessing certain types of data. Additionally, planning should include a clear methodology for evidence collection, ensuring that all steps adhere to legal and ethical standards, and are capable of withstanding scrutiny in legal proceedings.

In my experience with information security investigations, I've learned the importance of meticulous planning. Clearly defined objectives and documented scopes are crucial, setting the direction for the entire investigation. Playbooks have been valuable tools, guiding us step by step and helping identify key stakeholders like legal and management teams. Identifying stakeholders early is vital. The legal team ensures we comply with the law and ethical standards during evidence collection. Maintaining a secure chain of custody for evidence integrity is equally essential. Planning ahead and involving stakeholders streamline investigations, ensuring ethics and legality. This approach has proven invaluable.

Documentation is key of course but with it is also important of quickly identifying anomalies and then reaching a cause an effect relationship between relevant events having dug through the required rabbit holes. One of the most important things to keep in mind for accuracy are the logs and their meaning. A lot of times analysts would be making a leap of faith and come up with a hunch or hypothesis that is a good practice over time it is observed these hunches (at least for good analysts) start to get closer and closer to the actual story, but without the proper logs and contextualization it could be a very problematic thing.

In my experience collecting evidence during an investigation is essential for understanding, the root cause (1) Understand the specific incident and its impact (2) Isolate the affected device to prevent further spread and re-create the Instant for further analysis (3) Document all the steps (4) Analysis all the log to create forensic report.

Following a standard process in evidence collection is vital for maintaining the integrity and admissibility of evidence. This involves establishing a consistent method for evidence handling and documentation. For example, in digital forensics, this might include using write blockers when accessing hard drives to prevent altering data. Each step, from initial collection to final analysis, should be meticulously recorded. This process not only helps in maintaining the integrity of the evidence but also in creating a transparent trail that can be easily followed and understood by others, including legal professionals.

Follow a standard process When collecting evidence, you must follow a standard process that ensures the consistency, accuracy, and integrity of the evidence. You must also document each step of the process, including the date, time, location and personnel involved, as well as the actions taken, tools used and results obtained. You must also use appropriate tools and techniques that are suitable for the type and format of the test. For example, you may need to use specialized software or hardware to acquire, analyze, or preserve digital evidence, such as disk images, hashing, or encryption.

Adopting established frameworks, such as the Cybersecurity Investigation Framework or the Computer Security Incident Response Team (CSIRT) guidelines, provides a systematic and organized approach. The process typically begins with the identification and documentation of the incident, followed by the preservation of evidence through forensically sound procedures. Systematic analysis and examination of digital artifacts come next, allowing investigators to trace the origins and impact of the security incident. Throughout this process, adherence to a standardized methodology helps maintain consistency and transparency, facilitating collaboration among team members and ensuring that all pertinent aspects of the investigation are addressed.

Following a standard process for evidence collection is crucial, here are some tips to develop your process: Develop a Standard Operating Procedure (SOP): Have clear guidelines for every step of the evidence collection process, from initial identification to preservation and analysis. Use Forensic Tools and Techniques: Employ specialized forensic tools that can collect evidence without altering it. Ensure these tools are validated and accepted in the legal community.

In digital evidence collection, adherence to a standardized and detailed process is crucial. It begins with identification, following an order of volatility to preserve ephemeral data. The cybercrime scene, encompassing various devices and systems, must be protected against contamination. Meticulous documentation of each step, including operational and physical details of the devices, is essential. In the lab, evidence acquisition requires specific forensic tools and techniques for each type of device, ensuring integrity and minimizing data alterations. This systematic and rigorous approach ensures the admissibility and accuracy of evidence in information security investigations.

Basic requirement for following the process is to have an effective process in the first place. Organisations need to foresee various scenarios and have robust tools, systems & processes for people to follow when necessary. It’s also important to share with related people, train them and even do mock drills for using the process for better preparedness.

No haste. Most attacks will have started quite some time ago (about 10-24 months on average). Work as you would in an audit, be prepared to prove every note or observation you make "beyond reasonable doubt". There are many standard processes that are tried and tested, but it is imperative that the audit trail remains unbroken.

On Chain of Custody form it is a good practice to note the version no. of Forensic software used in this form "MAJOR.MINOR.REVISION.BUILDNUMBER"

As always, one of the risk factors in collecting complete and accurate evidence during an investigation is the "Human Error". Even with all the planning and processes in place, failure to properly handle or safeguard electronic components and the digital evidence by an individual is always a risk factor that should be considered to avoid the data becoming inadmissible in court and controls must be planned ahead to minimize this risk.

Maintaining the chain of custody is essential to ensure that evidence is not tampered with or altered. This involves detailed logging of who collected the evidence, when it was collected, and who has had access to it since collection. For digital evidence, this might include logs of file access and transfers. The chain of custody must be meticulously maintained to ensure that the evidence is considered reliable and is admissible in court. Any break or inconsistency in the chain can lead to questions about the integrity of the evidence.

Maintaining the chain of custody is crucial for preserving the integrity and admissibility of evidence in an investigation. The chain of custody refers to the chronological documentation or paper trail showing the collection, control, transfer, analysis, and disposition of physical evidence. Here's how you can ensure the proper maintenance of the chain of custody: Documentation Sealing and Labeling Chain of Custody Form Handoffs and Transfers Secure Storage Access Logs Regular Audits Secure Transportation Digital Evidence Considerations Adhere to Standard Operating Procedures (SOPs) Legal and Ethical Compliance Expert Consultation

Evidence is very important factor to display stakeholders and explain the risk in PT. In that process we need to validate the each and every evidence to ensure the integrity and accuracy of the evidences.

Maintaing the chain of custody is the crux of the forensic process. It is as important as taking logs of the first time you came in contact with the digital evidence to any exchanges that occur within the life cycle of data. Beyond its importance in forensic analysis, there is legal importance of ensuring effective documentation of the chain of custody to ensure your evidences are tenable.

The chain of custody is the essence of evidence and preserving it needs planning to ensure evidence is preserved with the integrity needed to go through a court. Any tamper will lead to lack of trust and thereby the evidence cannot be used for the intended purpose.

Maintaining the chain of custody is crucial for preserving the integrity of evidence. Here are some key steps: 1. Documentation: 2. Secure Storage: 3. Sealing: 4. Labeling 5. Authorized Personnel: 6. Transportation: 7. Chain of Custody Forms: 8. Training: 9. Regular Audits: 10. Court Admissibility: Remember, the goal is to create a transparent and unbroken trail of custody from the collection of evidence to its presentation in court.

The custody of records are extremely important as investigation base remains with that. To ensure this one should follow bellow steps 1. Clearly defining custodian for record with restrictive access 2. All digital record should be kept in audit enabled environment. 3. All manual record should be on lock and key with restrictive access and having high level of monitoring. 5. The access of record should be under automatic surveillance . 6. Clear sop on who and when access matrix.

Verifying and validating evidence involves ensuring its accuracy and relevance to the case. This might include cross-referencing digital evidence with logs or other data sources, or confirming the authenticity of physical evidence through forensic techniques. It's important to critically assess the evidence to ensure it supports or refutes the case hypotheses. This step often involves collaboration with experts in various fields, depending on the nature of the evidence.

Analyze the collected evidence to identify the root cause of the incident and understand the scope of the compromise. Correlate findings across different sources to build a comprehensive understanding of the incident.

Verify and validate evidence Verifying and validating evidence means checking whether the evidence is accurate, complete, and relevant to the investigation. You must also compare and correlate the evidence with other sources of information, such as reports, records, or witnesses, to confirm or refute the findings. You must also test and evaluate evidence using reliable and repeatable methods, such as scientific analysis, peer review, or expert opinion. You must also document any errors, discrepancies, or limitations in the evidence, as well as the assumptions and hypotheses made during the investigation. Thanks!

Again this is a procedure that should be documented and tested. In any situation testing and repeating is key. As is mentioned test and validate evidence is vital but the evidence comes in many forms which need to be considered in the plan.

If the evidence being relied upon is a system generated report, it is important to understand how the report is generated to establish it’s completeness. Sometimes there are multiple stages involved where data might get filtered out. It’s important to understand the exclusions either by reviewing the script or report logic or reconciling with thw source information. If this is not feasible for the full population it can be done for a sample. Also check access to such information is restricted appropriately.

With any investigation, thorough documentation is the backbone of a properly executed investigation. Maintaining a centralized repository for easy retrieval and reference can be the difference in your case.

Absolutely use the four eyes principle with evidence, and where possible, validate against a second source. Your investigation report will lose credibility quickly should someone find an error in the evidence.

In investigative journalism, the (at least) four-eyes-principle is key to guarantee accuracy. Fact-checking should always be carried out by someone who has not been involved in the investigation, to assure an independent assessment.

Hackers will create obvious tracks to mislead the investigators to assign the blame to certain hacker groups or countries. Investigate the tracks and be careful with assumptions.

Effectively reporting and presenting evidence is crucial for conveying findings to stakeholders. This involves summarizing the investigation's outcomes, highlighting key pieces of evidence, and explaining their relevance to the case. The presentation should be clear and understandable to those without technical expertise, especially in legal contexts. This might involve creating visual representations of data or simplifying technical language.

Once the investigation is complete, it's essential to compile a comprehensive and well-organized report. This report should include a summary of the investigation's findings, the methodology employed, and a clear presentation of the collected evidence. Effective reporting is crucial for conveying the investigative process and outcomes to stakeholders, legal authorities, or any relevant parties.

Effectively communicate investigation findings by reporting and presenting evidence to stakeholders. Summarize results using clear, concise, and objective language, accompanied by supporting documentation. Utilize appropriate formats like reports, charts, or graphs, and be prepared to address questions or challenges from the audience.

Communication is key! Ensure that the right communication steps are taken and the correct information shared with the right people. Information is useless unless presented correctly.

To collect complete and accurate evidence during an investigation, it is important to identify relevant sources, preserve the integrity of physical evidence, and utilize forensic methods to collect digital evidence. Documenting all steps in detail, organizing and analyzing evidence are crucial steps. When presenting evidence, be clear and objective, using visual aids when appropriate. Maintain the confidentiality of sensitive information and follow applicable laws and regulations. In complex cases, it is recommended to seek guidance from experts in forensic investigation to ensure the accuracy and validity of the evidence collected.

Vital step! Reporting and presenting evidence clearly is essential for conveying results and conclusions to key stakeholders. Comprehensive documentation and strong evidence support findings. Using clear, concise language and appropriate formats enhances understanding. Additionally, readiness to address questions demonstrates professionalism. Thanks for emphasizing the significance of this phase in managing confidential data incidents!

Reporting and presenting the evidence means summarizing and communicating the results and conclusions of the investigation to the relevant stakeholders, such as management, clients, or law enforcement. You should also provide the supporting documentation and evidence that shows how you arrived at the results and conclusions. You should also use clear, concise, and objective language, as well as appropriate formats and media, such as reports, charts, or graphs, to convey the message. You should also be prepared to answer any questions or challenges that may arise from the audience.

You will have multiple formats of your report, at the very least, a full detailed report, and an executive report. In all reports, you must remain dispassionate. Give only conclusions fully supported by evidence. Know your audience, the internal teams such as IT, DevOps will want a technical breakdown, and will ask questions geared to their area of expertise. Executives want the big picture, in 15 minutes or less, questions will revolve around 'how did this happen', 'what is our current risk', and similar. You will want the CISO and others available to assist since risk assessment falls outside the scope investigation reporting.

Maintain confidentiality if required by legal team, and involve only a limited set of experts in the exercise. Once completed and communications validated by legal, a general readout might be scheduled.

Report and present evidence Reporting and presenting evidence means summarizing and communicating the results and conclusions of the investigation to relevant stakeholders, such as management, customers, or law enforcement. You must also provide supporting documentation and evidence that shows how you arrived at the results and conclusions. You must also use clear, concise and objective language, as well as appropriate formats and media, such as reports, tables or graphs, to convey the message. You must also be prepared to respond to any questions or challenges that may arise from the audience. Thanks

You do not want to scramble in the middle of the night, looking for a forensic firm to call. You want to have an incident firm on retainer. Furthermore, I highly recommend you to do "tabletops" - it costs almost nothing - and tests your Executive team for preparedness.

It is important to be prepared for an incident. When an anomaly turns into an incident and you are not prepared, the incident will likely cause a severe crisis and significant damage. Here are my suggestions: - Invest in people, this is fundamental. - Do exercises on Tabletops. They are very useful. - Have a well-planned preparation phase, it can reduce financial impacts. - Have a previously hired incident response team.

In addition to these steps, it's important to consider the evolving nature of evidence, especially in the digital realm. With the rapid advancement of technology, new forms of digital evidence are constantly emerging, and investigative techniques must adapt accordingly. For instance, the rise of cloud computing presents new challenges and opportunities for evidence collection. Investigators must stay abreast of these changes to effectively collect and analyze evidence. Additionally, considering ethical implications, especially in cases involving personal data, is crucial.

If the company has onboarded cyber insurance, there are additional protocols that they would need to follow and adhere to (e.g. such as using authorized panel of IR specialists, and/or specific acquisition standards/methodology). This is not to be overlooked - as there will be an impact towards the adjudication/claim later

💡Lessons learned. Everytime you deal with a threat, could be the last one, if you learn with the Lessons from the incident. (Always depend on yourself) This is the main reason to consider the root cause and how to avoid it on next time. Awareness programs inside of the company, technically or not, this need to be considered to create a mature environment.

1. When defining the process one should also consider Regulatory requirements. Each country/ region may have different requirements and to collectively have this combined into the process. 2. PII and personal data is involved then one needs to be more vigilant in handling evidences till the closure of investigation.

Creo que un SGSI basado en la ISO 27001:2022, con nivel de madurez minimo 3 (CMMI) y complementado con la norma ISO/IEC 27037:2012 actualizada, la cual proporciona pautas para el manejo de la evidencia digital; sistematizando la identificación, recolección, adquisición y preservación de la evidencia, se logra tener un proceso controlado, eficiente y proactivo. Lo que permite un trabajo más expedito al analista forense y por consiguiente lograr la resolución precisa en un tiempo menor.

-Would the incident require additional security blueprints? - was it a due to a failure of the technology, the process or the people? Accordingly upgrade tech stack, review the process or arrange for mandatory training