1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.
-
Upload
destinee-timblin -
Category
Documents
-
view
219 -
download
2
Transcript of 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.
![Page 1: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/1.jpg)
1
FORENSIC INVESTIGATIONPROCESS
PRESENTED BYDAVE MAUPIN
SECURITY MANAGEMENT PARTNERSWALTHAM, MA
WWW.SMPONE.COM
![Page 2: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/2.jpg)
2
Your Speaker: Dave Maupin, CISA, CRISC, CISSP, and EnCE
MIT graduate with 30 years of experience in IT Senior Information Security Consultant for Security
Management Partners. PCI QSA Forensic investigations with IT, HR and Legal
departments for various regulated industries such as banking, healthcare and pharmaceutical.
![Page 3: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/3.jpg)
3
Common investigation scenarios ACH fraud Embezzlement Harassment Civil case
![Page 4: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/4.jpg)
4
Tools
1. Encase Forensic 7.072. Antivirus software3. Malwarebytes4. Excel5. Volatility6. HBGary Responder CE7. Mandiant Redline8. Knowledge of Windows technical details
![Page 5: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/5.jpg)
5
ACH Fraud Funds moved electronically from business
online banking account Investigate—initial information gathering
from the financial institution and the business customer
Acquire media using chain of custody protocol
Forensic analysis—acquire forensically and run analysis
![Page 6: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/6.jpg)
6
Timeline AnalysisEntry Date Entry Full Path Entry Type
08/24/10 11:29:11AM C\WINDOWS\Prefetch\WINZIP32.EXE-2F3C90C9.pf Created Date
08/24/10 11:29:11AM C\WINDOWS\Prefetch\WINZIP32.EXE-2F3C90C9.pf Written Date
08/24/10 11:29:11AM C\WINDOWS\Prefetch\WINZIP32.EXE-2F3C90C9.pf Modified Date
08/24/10 11:29:16AM
C\Documents and Settings \User.Domain\Cookies\[email protected][2].txt Accessed Date
800 entries for cookies on the system
08/24/10 11:29:21AM
C\Documents and Settings \User.Domain\Cookies\[email protected][2].txt Accessed Date
![Page 7: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/7.jpg)
7
Embezzlement
Funds stolen from business Investigate—initial information gathering
from the business Acquire media using chain of custody
protocol Forensic analysis—acquire forensically
and run analysis
![Page 8: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/8.jpg)
8
Data Hiding
Changing the extension on a file. Embedding data in a graphic file or scanning a
document so that it becomes a graphic file. This would prevent the text within the document from being identified during a keyword search.
Using a compression utility to compress multiple files or documents into a single compound file (i.e. .zip file).
Encryption: using a utility such as TrueCrypt to create a hidden\encrypted volume on the hard drive.
![Page 9: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/9.jpg)
9
Civil Case
Intellectual property stolen from business Investigate—initial information gathering
from the business Acquire media using chain of custody
protocol Forensic analysis—acquire forensically
and run analysis
![Page 10: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/10.jpg)
10
Shortcuts (.lnk files)
Shortcuts contain a volume serial number In order for these Link files to have been
created on the hard drive, the USB drive had to have been plugged into the computer containing the hard drive on which the Link files were located and a file from the USB drive had to have been accessed from that computer.
![Page 11: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/11.jpg)
11
Harassment
Employee reports harassment to HR Investigate—initial information gathering
from the business Acquire media using chain of custody
protocol Forensic analysis—acquire forensically
and run analysis
![Page 12: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/12.jpg)
12
System Restore
System Restore uses a feature called system protection to regularly create and save restore points on your computer. These restore points contain information about registry settings and other system information that Windows uses.
People trying to hide their activities may not realize that information has been saved by System Restore
![Page 13: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/13.jpg)
13
Best Practices A/V definitions change daily, full scans
should be run at least weekly Investigate what your a/v console reports Investigate unusual events:
Account lockouts Use a minimum necessary approach
throughout your environment: Block outbound traffic Only give access to social media to those with
a business need (marketing) Block webmail access
![Page 14: 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.](https://reader035.fdocuments.net/reader035/viewer/2022062421/56649c785503460f9492e19c/html5/thumbnails/14.jpg)
14
Best Practices, continued
Train your users Call the help desk Be careful with email attachments