Clearing the Brush: Lessons Learned in Gutting a CIRT and Rebuilding - PowerPoint PPT Presentation

Clearing the Brush: Lessons Learned in Gutting a CIRT and Rebuilding with Free Tools Mike La Pilla

Slide Warning • These are draft slides, not the ones presented • Most images have been removed from draft • If you are reading these you should check the FIRST portal for the latest ones

About This Presentation • Everyone Has Their Own Take • Plenty of Papers on This Subject • Focus on Building 10 Essential Tools/Systems – Preferably without spending money

If You Want Organization and Structure • http://first.org/resources/guides/ – CSIRT Setting up Guide – CERT-in-a-box • http://www.sans.org/reading_room/whitepap ers/incident/ • Also stuff on Auscert, CERT/CC, GFIRST, etc

Past vs Present

Preparation by Preservation • Picture of frozen hard drive

Preparation by Obliteration • Picture of Bar

Know Your Scope • Areas of Response • Actions Allowed • Contact List

Know Your People

Beware of Certifications

Attack Categories

10 Systems You Need To Build

1: Automatic Malware Analysis System • Purpose: Automatically process malware samples • Recommended Features: Fast, Exe and DLL, Memory Dumps

1: Automatic Malware Analysis System

2: Automatic JS Analyzer • Purpose: Unpack/Analyze/Interpret Javascript • Recommended Capabilities: Network replay, live site analysis, copy and paste

2: Automatic JS Analyzer

3: Automatic Document Analyzer • Purpose: Analyze non-executable documents • Recommended Capabilities: Exploit matching, decompression, javascript/flash parsing

3: Automatic Document Analyzer

4: Document Database • Purpose: Archive documents • Recommended Capabilities: Store name, file properties, metadata, link malware info

4: Document Database

5: Malware Repository • Purpose: Store malware • Recommended Capabilities: Search, store properties, link to other systems

5: Malware Repository

6: IP and Hostname Tracker • Purpose: Track network information over time • Recommended Capabilities: Passive DNS, active checking, search, ASN, GeoIP

6: IP and Hostname Tracker

7: Forensics System/Lab • Purpose: Forensic analzye drives, memory • Recommended Capabilities: Scanning, automation, hashing

7: Forensics System/Lab

8: Image Repository • Purpose: Replicate machines in production environment

8: Image Repository

9: Tiny Tools Server • Purpose: Collection of scripts and tools that increase efficiency

9: Tiny Tools Server

10: Documentation Portal • Purpose: Self-explanatory Recommended Capabilities: Revisions, author tracking

10: Documentation Portal

Final Workflow Diagram

Questions? • mlapilla@netcentrics.com

References

Clearing the Brush: Lessons Learned in Gutting a CIRT and Rebuilding - PowerPoint PPT Presentation

Clearing the Brush: Lessons Learned in Gutting a CIRT and Rebuilding with Free Tools Mike La Pilla Slide Warning These are draft slides, not the ones presented Most images have been removed from draft If you are reading these you

Lessons Learned Lessons Learned From From Lessons Learned Lessons Learned From From

CIRT C ritical I ncident R esponse T eam What is CIRT? CIRT is the Critical Incident Response Team

Institutionalizing Lessons Learned October 25, 2006 Loren Plisco Region II Background

OSHA Lessons Learned Adam Fries OSHA Compliance Officer February 13, 2018 OSHA Lessons Learned

3/8/2019 Epidemiology, Risk Factors, and Outcomes of Pediatric PVD: LESSONS learned from the

DEBUGGING LESSONS LEARNED WHILE DEBUGGING LESSONS LEARNED WHILE FIXING NETBSD FIXING NETBSD

TWO-GANTRY, FIVE-BRUSH MACHINES Objective NET.5 is a 2-gantry, 5-brush machine remarkable

1.- How does clearing work? 1 CCP clearing Actors involved Actions Client An

Lessons Learned A Value Added Product of the Project Life Cycle R Gilman April 19, 2006 Agenda

UNIVERSITY CLEARING 2020 What is clearing? Clearing is how Universities and colleges fill

Four Major Events in Our History and the Lessons Learned Coleen Reiswig, Isobel McDonald, Ted

Lessons Learned from Japans NPL Experience Ladies and gentlemen, today I would like to discuss

Some lessons learned from Team Science Some lessons learned from Team Science Lewis Cantley Weill

VALUE: Lessons Learned Kate McConnell & Erin Horan Association of American Colleges and

MDG-SDG TRANSITION IN IVORY COAST: LESSONS LEARNED AND IMPLICATIONS ON CURRENT PUBLIC POLICIES

FACILITATED BY: Robin Booth, CPA 2 Training Topics Lessons Learned Best Practices

Defeat the Disruption of Assessment at a Distance: Too Much Data, Not Enough Time Alejandra

Yasunori Nomura UC Berkeley; LBNL Particle physics Try to understand fundamental laws in

THEIR EFFECTIVE PHYSICS Denis Klevers University of Pennsylvania "New Ideas at the

t

Prst r t

Improving CG-CAHPS in an Academic Medical Center Rick Evans, MA Senior Vice President &

Implementing RPKI-based origin validation one country at a time. The Ecuadorian case study.

Interaction Vertex Imaging (IVI) for carbon ion therapy monitoring a feasibility study E. Testa 1

Clearing the Brush: Lessons Learned in Gutting a CIRT and Rebuilding - PowerPoint PPT Presentation

Clearing the Brush: Lessons Learned in Gutting a CIRT and Rebuilding with Free Tools Mike La Pilla Slide Warning These are draft slides, not the ones presented Most images have been removed from draft If you are reading these you

Lessons Learned Lessons Learned From From Lessons Learned Lessons Learned From From

CIRT C ritical I ncident R esponse T eam What is CIRT? CIRT is the Critical Incident Response Team

Institutionalizing Lessons Learned October 25, 2006 Loren Plisco Region II Background

OSHA Lessons Learned Adam Fries OSHA Compliance Officer February 13, 2018 OSHA Lessons Learned

3/8/2019 Epidemiology, Risk Factors, and Outcomes of Pediatric PVD: LESSONS learned from the

DEBUGGING LESSONS LEARNED WHILE DEBUGGING LESSONS LEARNED WHILE FIXING NETBSD FIXING NETBSD

TWO-GANTRY, FIVE-BRUSH MACHINES Objective NET.5 is a 2-gantry, 5-brush machine remarkable

1.- How does clearing work? 1 CCP clearing Actors involved Actions Client An

Lessons Learned A Value Added Product of the Project Life Cycle R Gilman April 19, 2006 Agenda

UNIVERSITY CLEARING 2020 What is clearing? Clearing is how Universities and colleges fill

Four Major Events in Our History and the Lessons Learned Coleen Reiswig, Isobel McDonald, Ted

Lessons Learned from Japans NPL Experience Ladies and gentlemen, today I would like to discuss

Some lessons learned from Team Science Some lessons learned from Team Science Lewis Cantley Weill

VALUE: Lessons Learned Kate McConnell &amp; Erin Horan Association of American Colleges and

MDG-SDG TRANSITION IN IVORY COAST: LESSONS LEARNED AND IMPLICATIONS ON CURRENT PUBLIC POLICIES

FACILITATED BY: Robin Booth, CPA 2 Training Topics Lessons Learned Best Practices

Defeat the Disruption of Assessment at a Distance: Too Much Data, Not Enough Time Alejandra

Yasunori Nomura UC Berkeley; LBNL Particle physics Try to understand fundamental laws in

THEIR EFFECTIVE PHYSICS Denis Klevers University of Pennsylvania &quot;New Ideas at the

t

Prst r t

Improving CG-CAHPS in an Academic Medical Center Rick Evans, MA Senior Vice President &amp;

Implementing RPKI-based origin validation one country at a time. The Ecuadorian case study.

Interaction Vertex Imaging (IVI) for carbon ion therapy monitoring a feasibility study E. Testa 1

VALUE: Lessons Learned Kate McConnell & Erin Horan Association of American Colleges and

THEIR EFFECTIVE PHYSICS Denis Klevers University of Pennsylvania "New Ideas at the

Improving CG-CAHPS in an Academic Medical Center Rick Evans, MA Senior Vice President &