Information security, 'CSI' style

By Niall McKay, Contributor 01 Mar 2006 | SearchSecurity.com

Security Wire Daily News Digg This!     StumbleUpon     Del.icio.us

SAN JOSE, Calif. -- Computer security experts should start watching CSI. It's one way they can learn how to employ the methodology of the popular TV drama's real-world forensics counterparts when investigating cyber break-ins -- including leaving systems alone until proper authorities arrive on the scene.

That's the advice from Jon Orbeton, senior security analyst with Check Point Software Technologies Ltd.'s Zone Labs division, who sometimes assists with digital crime scene investigations. Orbeton said catching digital intruders isn't as easy as it often looks on the small screen.

"Cybersecurity professionals usually use what I call the 'follow the bread crumb approach,' going from log to log, trying to follow the hacker," said Orbeton, who has worked with the FBI, the UK's Scotland Yard and the U.S. Secret Service. "But how can they be sure that the intruder is still not in your system?"

When an enterprise suspects a crime's been committed against its network or data stores, it's important that the feds get the first crack at solving the crime. However, there are certain things information security personnel should do to assist the real crime fighters.

"They should make sure that they do not limit it to one or two servers but look at the whole network as a crime scene," Oberton advised official investigators during a session at the recent 2006 RSA Security Conference. Similarly, just as police collect fingerprints, digital forensics experts should collect checksum data (a numerical identifier). And while CSIs look for behavior patterns, such as the use of lock picks, corporate security officers can analyze digital patterns, such as the use of stack overflows.

Likewise, an autopsy can be likened to a "digitopsy," a network area search for the equivalent of fingerprints, footprints or tire marks -- only in this case it's checksums, IP addresses and unique strings.

More on RSA 2006 To see all of our special coverage of the 2006 RSA Security Conference, visit our coverage page at: http://searchsecurity.com/rsa06

Once this evidence is collected, Orbeton employs a three-phase approach to his own investigations. He reviews all known compromised systems, creates an attacker profile and applies that profile to all other systems in the network.

The profile can include information on strings with suspicious binaries, byte code for stolen data, checksums of attacker tools and even dates and times.

"You need to create a string long enough to not produce too many false positives but not so long as to not produce any hits," said Orbeton. "I've gotten results by putting the strings into Google because sometimes profile data can be posted on news groups."

Once the profile string is complete, Orbeton creates a floppy disk that will collect a MAC time snapshot of the machine, searches for the profile string, encrypts the results and sends them to a database so that the information can be catalogued and searched.

These methods have served Orbeton well in the past. Once he was called in to find an intruder during an investigation of the theft of millions of credit cards.

"We used conventional forensics, created an attacker profile, searched all the systems in the network and found three previously unknown systems that had been compromised," Oberton said. That is how his team found how the network had been penetrated, and later apprehended the perpetrator. Oberton, though, declinded to identify the identity of the thief or the organization involved.

Niall McKay is a freelance technology writer based in Oakland, Calif.

Tags: Information Security Incident Response,  Network Intrusion Detection (IDS),  Security Event Management,  Monitoring Network Traffic and Network Forensics,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Information Security Incident Response Data breach notification legislation: What info must be released? Incident response planning Mature SIMs do more than log aggregation and correlation New partnerships, creative thinking help security bust recession Senators hear call for federal cybersecurity restructuring Tying log management and identity management shortens incident response Tabletop exercises sharpen security and business continuity Security incident response 101 Firms muddle security breach response, expert says Microsoft Conficker worm offers attack prevention lesson Information Security Incident Response Research Network Intrusion Detection (IDS) Preventing SQL injection attacks: A network admin's perspective Lifecycle of a network security vulnerability Best Intrusion Prevention and Detection Products Rogue AP containment methods SIMs tools and tactics for business intelligence IPS and IDS deployment strategies Know when you need IDS, IPS or both Trend Micro to acquire Third Brigade for virtualization, cloud security New product aims to control rogue applications that avoid firewalls How to perform a network forensic analysis and investigation Network Intrusion Detection (IDS) Research Security Event Management Network traffic collection, analysis helps prevent data breaches Best Security Information and Event Management Products Understanding PCI DSS compliance requirements for log management Data breach notification legislation: What info must be released? How to prevent a denial-of-service (DoS) attack Mature SIMs do more than log aggregation and correlation The top 5 network security practices SIMs tools and tactics for business intelligence SIEM: Not for small business, nor the faint of heart Should IDS and SIM/SEM/SIEM be used for network intrusion monitoring?

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary incident response  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary