NCIRC Security Tools NIAPC Submission Summary Encase Enterprise Edition

Transcription

1 NCIRC Security Tools NIAPC Submission Summary Encase Enterprise Edition Document Reference: Security Tools Internal NIAPC Submission NIAPC Category: Forensics Date Approved for Submission: Evaluation/Submission Agency: NCIRC Issue Number: Draft 0.01 NATO UNCLASSIFIED RELEASABLE TO THE INTERNET

2 TABLE of CONTENTS 1 Product Category Role Overview Certification Company Country of Origin Web Link Product Description Product Requirements Technical Requirements Limitations Evaluation/Review Conclusions/Comments...5 NATO UNCLASSIFIED RELEASABLE TO THE INTERNET Page 2 of 5

3 1 Product Encase Enterprise Edition version Category Forensics. 3 Role Online and offline forensic investigation suite of tools. 4 Overview EnCase Enterprise (EE) is used for Incident Response, Information Risk Auditing, and Forensic Discovery. It provides network-based forensic and examination tools to simplify and greatly enhance anytime, anywhere investigations on an Enterprise-wide basis. 5 Certification This product has not undergone certification. 6 Company Guidance Software Inc 7 Country of Origin USA. 8 Web Link 9 Product Description EnCase Enterprise (EE) is the world s first enterprise investigation and incident response solution that allows organizations to conduct incident response, forensic analysis, and discovery (IRFAD) activities effectively. Computer incident response teams (CIRTs) and computer investigators can conduct immediate preview, analysis, documentation, and forensic imaging of workstations and media over local and wide area networks (LAN/WAN). EE is a secure, multithreaded, scalable platform, providing immediate incident response, forensic investigations and proactive auditing to the largest enterprise networks. This allows anytime, anywhere investigations. Dynamic capabilities allow recovery of deleted or damaged files, tracking and following the trail of events, and archiving disk images for evidentiary use and restoration. EnCase Enterprise is comprised of three main components: SAFE NATO UNCLASSIFIED RELEASABLE TO THE INTERNET Page 3 of 5

4 The SAFE (Secure Authentication For EnCase) is a physically and logically secured server that authenticates all users and controls all access to the network devices. Examiner The EnCase Examiner provides a comprehensive solution of advanced, network investigative tools Servlets Servlets are EnCase services running on network workstations and servers that provide bit-level access to the machine where they reside. Other terms to be familiar with: Network Device Typically a computer, a device on the network that the SAFE can access. Investigator The user sitting at the computer with the Examiner installed. Subject or Subject computer The computer or media that the investigator actually investigates. All data transfer between the Examiner client and the SAFE server and between the SAFE server and the network devices use 128-bit Advanced Encryption Standard (AES). The combination of these components provides a powerful and flexible framework that delivers enterprise-wide incident response, forensic analysis, and discovery (IRFAD) Incident Response On-demand response to internal and external incidents that provides accurate incident identification and analysis to ensure optimal corrective action. Forensic Analysis and Discovery EnCase Enterprise supports thorough forensic discovery, investigations and analysis utilizing the world s most advanced forensic software. 10 Product Requirements EnCase Forensic Edition V5 recognizes the following file systems: FAT12, FAT16, FAT32, NTFS, EXT2 (Linux), EXT3 (Linux), Reiser (Linux), UFS (Sun Solaris), AIX Journaling File System (JFS and jfs), LVM8, FFS (OpenBSD, NetBSD and FreeBSD), Palm, HFS, HFS+ (Macintosh), CDFS, ISO9660, UDF, DVD, Tivo1 and Tivo2 file systems. 11 Technical Requirements Guidance Software recommends the following minimum hardware requirements for EnCase Enterprise Edition: SAFE Windows 2000 or 2003 Server 1.5+ GHz Pentium IV Processor (2.4 GHz Pentium IV Processor or better recommended) 512 MB of RAM (1 GB or more recommended) 1 dedicated USB Port / Gigabit Network Card Not recommended for Evidence storage EXAMINER Windows 2000, XP, or 2003 Server 2.0 GHz Pentium IV Processor (3.0 GHz Pentium IV Processor or better recommended) 1 GB of RAM (2 GB or more recommended) 1 dedicated USB Port (when not using NAS) / Gigabit Network Card Ample data storage for evidence file acquisitions recommended (500GB or more) SERVLET Available for Windows, NT, 2000, XP, and 2003 Server; Linux kernel 2.4 and above, designed for Red Hat, SuSE & Mandrake; Sun Solaris 8 & 9, both 32- and 64-bit processors, AIX 4.3, 5.1,5.2 & 5.3 and MAC OSX version 10.2,10.3, & NATO UNCLASSIFIED RELEASABLE TO THE INTERNET Page 4 of 5

5 12 Limitations Large capacity storage devices are needed to hold the generated images of hard disks. NITC approval must be sought for use of as this application as inappropriate and misconfigured software can cause severe network infrastructure degradation and data loss. 13 Evaluation/Review Conclusions/Comments The Encase software offers industry proven forensic tools. NATO UNCLASSIFIED RELEASABLE TO THE INTERNET Page 5 of 5