A Strategic Approach

Though cyber forensics or incident response has become a vital need for the
growing cyber threats against the enterprises, it is generally overlooked until
a major security breach occurs. These result in an unnecessary time and monetary
loss, not to mention the stress associated with crisis management.

As enterprise networking environments continue to expand in diversity, scope,
geography and the size of digital information progresses from a few hundred
megabytes per workstation to terabytes of local storage, the number of cyber
attacks or crime targeted towards enterprises grow manifold.

For an enterprise, the initial response time following an attack or incident
is the most crucial. Therefore, a calculated and planned response is an
organization's best line of defense to prevent the compromise of critical
business systems. An enterprise that lacks an internal team of cyber forensics
investigators may not be able to quickly stabilize its network and data or
preserve forensic evidences.

Best Approach

At a broader level cyber forensics can be broadly classified under four
steps

• Acquisition: This is a practice of digital evidence collection
  process, establishing specific steps for guaranteeing integrity of digital
  evidence and memory information collection.
• Examination and Querying: In this phase computers should not be
  simply turned on as every time a computer is powered on the access times of
  certain files is altered; this may be crucial information to the
  investigation. Ensure the protected media is write-protected. There are
  several methods that can be used to do this. The preferred practice will
  depend on experience, available tools, and company policy. The next step is
  creation of a bit-for-bit copy of seized data followed by identification and
  separating of potentially useful data from the imaged dataset.
• Normalization and Analysis: The purpose of this phase is to present
  only the necessary and relevant facts, to the proper people only. This helps
  them understand what occurred and what might need to be done. The extracted
  relevant data is normalized to a format or nomenclature that is easily or
  commonly understood by investigators.
• Reporting: This is the final stage where the analyzed data is
  presented in a persuasive and evident form, which can be understood by human
  investigators and can be produced in the court of law.

In a big enterprise the ability to rapidly detect and classify malicious
activity contained within network traffic is a challenging problem exacerbated
by large datasets and functionally limited manual analysis tools.

Cyber crime has forced the computer and law enforcement professionals to
develop new areas of expertise and avenues of collecting and analyzing evidence.
As network intrusions, malicious insiders and criminal/terrorist organizations
take aim at corporate networks, the ability to investigate these incidents is
becoming imperative. Corporates should seriously look for implementing internal
Incident Response team who can effectively address any kind of cyber attack.

Debasis Mohanty

mail@dqindia.com

The author works for an MNC as a senior security researcher