Clearing the Brush: Lessons Learned in Gutting a CIRT and Rebuilding - PowerPoint PPT Presentation

Clearing the Brush: Lessons Learned in Gutting a CIRT and Rebuilding with Free Tools Mike La Pilla

Slide Warning • These are draft slides, not the ones presented • Most images have been removed from draft • If you are reading these you should check the FIRST portal for the latest ones

About This Presentation • Everyone Has Their Own Take • Plenty of Papers on This Subject • Focus on Building 10 Essential Tools/Systems – Preferably without spending money

If You Want Organization and Structure • http://first.org/resources/guides/ – CSIRT Setting up Guide – CERT-in-a-box • http://www.sans.org/reading_room/whitepap ers/incident/ • Also stuff on Auscert, CERT/CC, GFIRST, etc

Past vs Present

Preparation by Preservation • Picture of frozen hard drive

Preparation by Obliteration • Picture of Bar

Know Your Scope • Areas of Response • Actions Allowed • Contact List

Know Your People

Beware of Certifications

Attack Categories

10 Systems You Need To Build

1: Automatic Malware Analysis System • Purpose: Automatically process malware samples • Recommended Features: Fast, Exe and DLL, Memory Dumps

1: Automatic Malware Analysis System

2: Automatic JS Analyzer • Purpose: Unpack/Analyze/Interpret Javascript • Recommended Capabilities: Network replay, live site analysis, copy and paste

2: Automatic JS Analyzer

3: Automatic Document Analyzer • Purpose: Analyze non-executable documents • Recommended Capabilities: Exploit matching, decompression, javascript/flash parsing

3: Automatic Document Analyzer

4: Document Database • Purpose: Archive documents • Recommended Capabilities: Store name, file properties, metadata, link malware info

4: Document Database

5: Malware Repository • Purpose: Store malware • Recommended Capabilities: Search, store properties, link to other systems

5: Malware Repository

6: IP and Hostname Tracker • Purpose: Track network information over time • Recommended Capabilities: Passive DNS, active checking, search, ASN, GeoIP

6: IP and Hostname Tracker

7: Forensics System/Lab • Purpose: Forensic analzye drives, memory • Recommended Capabilities: Scanning, automation, hashing

7: Forensics System/Lab

8: Image Repository • Purpose: Replicate machines in production environment

8: Image Repository

9: Tiny Tools Server • Purpose: Collection of scripts and tools that increase efficiency

9: Tiny Tools Server

10: Documentation Portal • Purpose: Self-explanatory Recommended Capabilities: Revisions, author tracking

10: Documentation Portal

Final Workflow Diagram

Questions? • mlapilla@netcentrics.com

References

Clearing the Brush: Lessons Learned in Gutting a CIRT and Rebuilding - PowerPoint PPT Presentation

Clearing the Brush: Lessons Learned in Gutting a CIRT and Rebuilding with Free Tools Mike La Pilla Slide Warning These are draft slides, not the ones presented Most images have been removed from draft If you are reading these you

CIRT C ritical I ncident R esponse T eam What is CIRT? CIRT is the Critical Incident Response Team

UNIVERSITY CLEARING 2020 What is clearing? Clearing is how Universities and colleges fill

Lessons Learned Lessons Learned From From Lessons Learned Lessons Learned From From

1.- How does clearing work? 1 CCP clearing Actors involved Actions Client An

Client clearing Warsaw, 15.10.2019 01. Client clearing in KDPW_CCP What new regulations are

TWO-GANTRY, FIVE-BRUSH MACHINES Objective NET.5 is a 2-gantry, 5-brush machine remarkable

Professional Clearing Member (PCM) Central Depository Company of Pakistan Professional Clearing

Ohio AAP Brush, Book, Bed: Brush (Oral Health) CME Disclaimer I have no personal financial

Cash Equity CCP Oslo Clearing Oslo Clearing Agenda Agenda Value proposition

1. Participation All Clearing Clearing Member KDPW_CCP Members Participation opening or

Central Clearing of OTC derivatives - OTC clearing from a Norwegian perspective Johan Christian

OVERVI EW OF MTN 015 AND OVERVI EW OF MTN 015 AND LESSONS LEARNED LESSONS LEARNED Peter Mutale

3/8/2019 Epidemiology, Risk Factors, and Outcomes of Pediatric PVD: LESSONS learned from the

OSHA Lessons Learned Adam Fries OSHA Compliance Officer February 13, 2018 OSHA Lessons Learned

Lessons Learned A Value Added Product of the Project Life Cycle R Gilman April 19, 2006 Agenda

Lessons Learned From Sequenced, Integrated Strategies of Economic After Hours Seminar

Defeat the Disruption of Assessment at a Distance: Too Much Data, Not Enough Time Alejandra

Yasunori Nomura UC Berkeley; LBNL Particle physics Try to understand fundamental laws in

THEIR EFFECTIVE PHYSICS Denis Klevers University of Pennsylvania "New Ideas at the

t

Prst r t

Improving CG-CAHPS in an Academic Medical Center Rick Evans, MA Senior Vice President &

Implementing RPKI-based origin validation one country at a time. The Ecuadorian case study.

Interaction Vertex Imaging (IVI) for carbon ion therapy monitoring a feasibility study E. Testa 1

Explore More Topics

Sambuz

Useful Links

Newsletter

Mail Us

Clearing the Brush: Lessons Learned in Gutting a CIRT and Rebuilding - PowerPoint PPT Presentation

Clearing the Brush: Lessons Learned in Gutting a CIRT and Rebuilding with Free Tools Mike La Pilla Slide Warning These are draft slides, not the ones presented Most images have been removed from draft If you are reading these you

CIRT C ritical I ncident R esponse T eam What is CIRT? CIRT is the Critical Incident Response Team

UNIVERSITY CLEARING 2020 What is clearing? Clearing is how Universities and colleges fill

Lessons Learned Lessons Learned From From Lessons Learned Lessons Learned From From

1.- How does clearing work? 1 CCP clearing Actors involved Actions Client An

Client clearing Warsaw, 15.10.2019 01. Client clearing in KDPW_CCP What new regulations are

TWO-GANTRY, FIVE-BRUSH MACHINES Objective NET.5 is a 2-gantry, 5-brush machine remarkable

Professional Clearing Member (PCM) Central Depository Company of Pakistan Professional Clearing

Ohio AAP Brush, Book, Bed: Brush (Oral Health) CME Disclaimer I have no personal financial

Cash Equity CCP Oslo Clearing Oslo Clearing Agenda Agenda Value proposition

1. Participation All Clearing Clearing Member KDPW_CCP Members Participation opening or

Central Clearing of OTC derivatives - OTC clearing from a Norwegian perspective Johan Christian

OVERVI EW OF MTN 015 AND OVERVI EW OF MTN 015 AND LESSONS LEARNED LESSONS LEARNED Peter Mutale

3/8/2019 Epidemiology, Risk Factors, and Outcomes of Pediatric PVD: LESSONS learned from the

OSHA Lessons Learned Adam Fries OSHA Compliance Officer February 13, 2018 OSHA Lessons Learned

Lessons Learned A Value Added Product of the Project Life Cycle R Gilman April 19, 2006 Agenda

Lessons Learned From Sequenced, Integrated Strategies of Economic After Hours Seminar

Defeat the Disruption of Assessment at a Distance: Too Much Data, Not Enough Time Alejandra

Yasunori Nomura UC Berkeley; LBNL Particle physics Try to understand fundamental laws in

THEIR EFFECTIVE PHYSICS Denis Klevers University of Pennsylvania &quot;New Ideas at the

t

Prst r t

Improving CG-CAHPS in an Academic Medical Center Rick Evans, MA Senior Vice President &amp;

Implementing RPKI-based origin validation one country at a time. The Ecuadorian case study.

Interaction Vertex Imaging (IVI) for carbon ion therapy monitoring a feasibility study E. Testa 1

Explore More Topics

Sambuz

Useful Links

Newsletter

Mail Us

THEIR EFFECTIVE PHYSICS Denis Klevers University of Pennsylvania "New Ideas at the

Improving CG-CAHPS in an Academic Medical Center Rick Evans, MA Senior Vice President &