Leveraging CybOX to Standardize Representation and Exchange of Digital Forensic Information
|
|
|
- Paul Norton
- 6 years ago
- Views:
Transcription
1 DIGITAL FORENSIC RESEARCH CONFERENCE Leveraging CybOX to Standardize Representation and Exchange of Digital Forensic Information By Eoghan Casey, Greg Back, and Sean Barnum Presented At The Digital Forensic Research Conference DFRWS 2015 EU Dublin, Ireland (Mar 23 rd - 26 th ) DFRWS is dedicated to the sharing of knowledge and ideas about digital forensics research. Ever since it organized the first open workshop devoted to digital forensics in 2001, DFRWS continues to bring academics and practitioners together in an informal environment. As a non-profit, volunteer organization, DFRWS sponsors technical working groups, annual conferences and challenges to help drive the direction of research and development.
2 DFAX: Digital Forensic Analysis expression Leveraging CybOX TM to Standardize Representation and Exchange of Digital Forensic Information Eoghan Casey, Greg Back, Sean Barnum
3 Outline Motivation Related work DFAX ontology Introduce a Unified Cyber Ontology (UCO) Using CybOX to represent digital evidence Provenance Actions, Action Patterns, Action Lifecycle Next steps
4 Motivation Share digital forensic information Investigations involving 2+ jurisdictions/agencies Share digital forensic knowledge Distinctive behavioral patterns to search for Combine results from multiple forensic tools Compare results from multiple forensic tools Automate tool validation & verification Structured data enables more advanced analysis high timelines, graph queries, behavioral analysis
5 What is a Cyber Observable? a measurable event or stateful property in the cyber domain measurable events: registry key is created, file is deleted stateful properties: MD5 hash of a file, value of a registry key How these observables relate (patterns) Actions (context and tool provenance) Already used in digital forensics (intrusions, malware, IoC) Autopsy, Volatility
6 Various Defined Object Schemas Account Address API Code Device Disk Disk Partition DNS Cache DNS_Record Message File GUI GUI Dialog Box GUI Window Library Linux Package Memory Mutex Network Flow Network Packet Network Route Entry Network Route Network Subnet Pipe Port Process Product Semaphore Socket System Unix File Unix Network Route Entry Unix Pipe Unix Process Unix User Account Unix Volume URI User Account User Session Volume Win Computer Account Win Critical Section Win Driver Win Event Win Event Log Win Executable File Win File Win Kernel Win Kernel Hook Win Handle Win Mailslot Win Mutex Win Pipe Win Network Route Entry Win Network Share Win Pipe Win Prefetch Win Process Win Registry Key Win Semaphore Win Service Win System Win System Restore Win Task Win Thread Win User Account Win Volume Win Waitable Timer X509 Certificate (more on the way) Page 5
7 Disk (Contains) Open Attach.DOC file Execute Flash content Download.MP4 downloader Execute Create Create.EXE trojan Registry Connect C&C URLs/IPs
8 Use Case: Detect Malicious Activity Snort Rules Diverse Sensors Common Patterns of Attack (CAPEC) Attack Flow Description Cyber Observable Characterization (CybOX) Events Stateful Measures Yara Rules CERE Rules Cyber Observable Characterization (CybOX) Events Stateful Measures Einstein SIEM Rules
9 STIX: Structured Threat Information expressions
10 Android Example Page 9
11 Related Work Digital Evidence Bags (DEB) XIRAF RDF Digital Evidence Exchange (DEX) Digital Forensic XML (DFXML) AFF4 DFAX Turner, 2005 Alink et al, 2006 Schatz, 2007 Levine & Liberatore, 2009 Garfinkel, 2009 Cohen, et al 2009 Open Source (DHS/MITRE) Open source Y N N/A Y Y Y Y Case Information Y Y N N N Y Y Integrity assurance Y Y Y Y Y Y Y Chain of custody Y N P N N Y Y Evidence details Y Y Y N N Y Y Tool details Y Y Y Y Y Y Y Storage media contents Y Y Y N Y Y Y Mobile device contents Y Y N N N N Y Assign object multiple types Y Y Y N N Y Y Parent-child relationships Y Y Y Y Y N Y Non-hierarchical relationships N N Y N N Y Y Actions N N Y N N N Y Action Lifecycles N N N N N N Y
12 DFAX Ontology
13 DFAX Ontology
14 DFAX Ontology
15 Digital Evidence in CybOX Traces of wiping (Observable or Pattern) <ProductObj:Product>Secure Delete</ProductObj:Product> <FileObj:File_Name>sdelete.exe</FileObj:File_Name> <cybox:relationship>characterizes</cybox:relationship> <WinRegistryKeyObj:Key>Software\Sysinternal\SDelete</WinRegist <cybox:relationship>created</cybox:relationship> <FileObj:File_Name condition="fitspattern">z+.z+</fileobj:file_name> <cybox:relationship">renamed_by</cybox:relationship>
16 Provenance Evidence source and handling Continuity of possession / Chain of custody Evidence processing Tools and transformations Evidence analysis Evaluation of source Need to expand CybOX (e.g., PRNU and ENF)
17 Provenance in DFAX/CybOX Evidence source and handling dfax:evidence Record dfax:forensic Action Evidence processing cyboxcommon:tool Evidence analysis Defined relationships
18 Action Lifecycle: Forensic Process Different groups define process differently Forensic Process 1 Forensic Process 2 Forensic Process 3 Forensic Process 4 Authorization Planning Planning Preparation Identification Identification Notification Preservation Reconnaissance Search Incident Response Collection Transport & Storage Collection Data Collection Examination Transport Analysis Analysis Storage Data Analysis Presentation Proof and Defense Examination Presentation of Findings Archive Storage Presentation Proof/defense Dissemination Incident Closure
19 Action Lifecycle: Subject Grooming (Sexual Assault) Victim selection Establish trust Desensitization to sexual activity/abuse Kill Chain (Intrusion) Reconnaissance Development Delivery Maintain secrecy (persuasion/threats) Exploitation Arrange meeting Conceal evidence Configuration Beaconing and C2
20 Actions {Subject, Victim, System} Action = USB Device Connected Represent & search structured characteristics FileObj:File_Name = setupapi.log IN FileObj:File_Path = C:\Windows\setupapi.log CONTAINS cyboxcommon:string_value = \DISK&VEN_KINGSTON&PROD_DATATRAVELER_3.0&REV_PMAP\8606E6D418ABE FAE&0] OR WinRegistryKeyObj:Name = HardwareID IN WinRegistryKeyObj:Hive = HKEY_LOCAL_MACHINE WinRegistryKeyObj:Key = \SYSTEM\CurrentControlSet\Enum\USBSTOR\ Disk&Ven_Kingston&Prod_DataTraveler_3.0&Rev_PMAP\08606E6D418ABE F AE&0 CONTAINS WinRegistryKeyObj:Data = USBSTOR\DiskKingstonDataTraveler_3.0PMAP
21 Note: Plaso Categorizes related events using tags Plaso events map to cybox:observables Plaso tags map to dfax:actions Plaso Application Execution tag includes: windows:prefetch:execution windows:lnk AND path contains.exe winreg AND userassist or mru winevt source = Security AND eventid = 592
22 Action Patterns Higher level, human understandable terms Reflect behaviors and objectives Assist in establishing modus operandi (a.k.a. TTP)
23 Representing Changes NIST Diskprint (before and after comparison) CybOX Actions Install program Execute program Use program Uninstall program
24 Next steps Community involvement DFAX/CybOX Python library Periodic Mobile Forensics Plaso Abstract concepts common across cyber domains Tools Actions & Action Lifecycle
Cyberattack Analysis and Information Sharing in the U.S.
Cyberattack Analysis and Information Sharing in the U.S. Promoting the sharing and utilization of the Analyzed Information Sean Barnum February 2013 Sponsored by the US Department of Homeland Security
Pull It Together. Enabling Interoperability of Digital Forensic Systems Using a Standard Representation and Supporting API
Pull It Together Enabling Interoperability of Digital Forensic Systems Using a Standard Representation and Supporting API Org 1 Sean Barnum, FireEye Ryan Griffith, DC3 Data source 1, 2 Org 2 Data source
Enabling Distributed Event Management: Interoperability for Automated Response and Prevention. Sean Barnum George Saylor Aug 2011
Enabling Distributed Event Management: Interoperability for Automated Response and Prevention Sean Barnum George Saylor Aug 2011 The HS SEDI FFRDC is managed and operated by The MITRE Corporation for DHS.
Cyber Threat Intelligence Sharing Standards
SESSION ID: PST-W08 Cyber Threat Intelligence Sharing Standards Jerome Athias Cybersecurity Specialist Saudi Aramco @JA25000 Agenda Cyber Threat Intelligence (CTI) CTI Sharing Standards Summary & Apply
Cyber Threat Intelligence Standards - A high-level overview
Cyber Threat Intelligence Standards - A high-level overview Christian Doerr TU Delft, Cyber Threat Intelligence Lab Delft University of Technology Challenge the future ~ whoami At TU Delft since 2008 in
Unification of Digital Evidence from Disparate Sources
DIGITAL FORENSIC RESEARCH CONFERENCE Unification of Digital Evidence from Disparate Sources By Philip Turner Presented At The Digital Forensic Research Conference DFRWS 2005 USA New Orleans, LA (Aug 17
Designing Robustness and Resilience in Digital Investigation Laboratories
DIGITAL FORENSIC RESEARCH CONFERENCE Designing Robustness and Resilience in Digital Investigation Laboratories By Philipp Amann and Joshua James Presented At The Digital Forensic Research Conference DFRWS
Tanium Endpoint Detection and Response. (ISC)² East Bay Chapter Training Day July 13, 2018
Tanium Endpoint Detection and Response (ISC)² East Bay Chapter Training Day July 13, 2018 $> WhoamI 11 Years of Security Experience Multiple Verticals (Technology, Industrial, Healthcare, Biotech) 9 Years
A Functional Reference Model of Passive Network Origin Identification
DIGITAL FORENSIC RESEARCH CONFERENCE A Functional Reference Model of Passive Network Origin Identification By Thomas Daniels Presented At The Digital Forensic Research Conference DFRWS 2003 USA Cleveland,
Automated Identification of Installed Malicious Android Applications
DIGITAL FORENSIC RESEARCH CONFERENCE Automated Identification of Installed Malicious Android Applications By Mark Guido, Justin Grover, Jared Ondricek, Dave Wilburn, Drew Hunt and Thanh Nguyen Presented
Categories of Digital Investigation Analysis Techniques Based On The Computer History Model
DIGITAL FORENSIC RESEARCH CONFERENCE Categories of Digital Investigation Analysis Techniques Based On The Computer History Model By Brian Carrier, Eugene Spafford Presented At The Digital Forensic Research
A Correlation Method for Establishing Provenance of Timestamps in Digital Evidence
DIGITAL FORENSIC RESEARCH CONFERENCE A Correlation Method for Establishing Provenance of Timestamps in Digital Evidence By Bradley Schatz, George Mohay, Andrew Clark Presented At The Digital Forensic Research
Multidimensional Investigation of Source Port 0 Probing
DIGITAL FORENSIC RESEARCH CONFERENCE Multidimensional Investigation of Source Port 0 Probing By Elias Bou-Harb, Nour-Eddine Lakhdari, Hamad Binsalleeh and Mourad Debbabi Presented At The Digital Forensic
Rapid Forensic Imaging of Large Disks with Sifting Collectors
DIGITAL FORENSIC RESEARCH CONFERENCE Rapid Forensic Imaging of Large Disks with Sifting Collectors By Jonathan Grier and Golden Richard Presented At The Digital Forensic Research Conference DFRWS 2015
Supply Chain Information Exchange: Non-conforming & Authentic Components
Supply Chain Information Exchange: Non-conforming & Authentic Components Joe Jarzombek Director for Software and Supply Chain Assurance Stakeholder Engagement & Cyber Infrastructure Resilience Agenda Purpose
On Criteria for Evaluating Similarity Digest Schemes
DIGITAL FORENSIC RESEARCH CONFERENCE On Criteria for Evaluating Similarity Digest Schemes By Jonathan Oliver Presented At The Digital Forensic Research Conference DFRWS 2015 EU Dublin, Ireland (Mar 23
Cyber Observables and Integration with EMAP EMAP 2011 Developer Days
Cyber Observables and Integration with EMAP EMAP 2011 Developer Days Sean Barnum Aug 2011 Knowledge Repositories Asset Definition Configuration Guidance Vulnerability Alert Threat Alert Incident Report
Cyber Common Technical Core (CCTC) Advance Sheet Windows Operating Systems
Cyber Common Technical Core (CCTC) Advance Sheet Windows Operating Systems Section 1: Command Line Tools Skill 1: Employ commands using command line interface 1.1 Use command line commands to gain situational
Fast Indexing Strategies for Robust Image Hashes
DIGITAL FORENSIC RESEARCH CONFERENCE Fast Indexing Strategies for Robust Image Hashes By Christian Winter, Martin Steinebach and York Yannikos Presented At The Digital Forensic Research Conference DFRWS
A Framework for Attack Patterns Discovery in Honeynet Data
DIGITAL FORENSIC RESEARCH CONFERENCE A Framework for Attack Patterns Discovery in Honeynet Data By Olivier Thonnard, Marc Dacier Presented At The Digital Forensic Research Conference DFRWS 2008 USA Baltimore,
Windows Forensics Advanced
Windows Forensics Advanced Index: CF102 Description Windows Forensics - Advanced is the next step for forensics specialists, diving deeper into diverse processes on Windows OS serving computer investigators.
Extracting Hidden Messages in Steganographic Images
DIGITAL FORENSIC RESEARCH CONFERENCE Extracting Hidden Messages in Steganographic Images By Tu-Thach Quach Presented At The Digital Forensic Research Conference DFRWS 2014 USA Denver, CO (Aug 3 rd - 6
OHLONE COLLEGE Ohlone Community College District OFFICIAL COURSE OUTLINE
OHLONE COLLEGE Ohlone Community College District OFFICIAL COURSE OUTLINE I. Description of Course: 1. Department/Course: CNET - 174 2. Title: Computer Forensics 3. Cross Reference: 4. Units: 3 Lec Hrs:
Privacy-Preserving Forensics
DIGITAL FORENSIC RESEARCH CONFERENCE Privacy-Preserving Email Forensics By Frederik Armknecht, Andreas Dewald and Michael Gruhn Presented At The Digital Forensic Research Conference DFRWS 2015 USA Philadelphia,
Developing a New Digital Forensics Curriculum
DIGITAL FORENSIC RESEARCH CONFERENCE Developing a New Digital Forensics Curriculum By Anthony Lang, Masooda Bashir, Roy Campbell and Lizanne Destefano Presented At The Digital Forensic Research Conference
Modern Cyber Defense with Automated Real-Time Response: A Standards Update
SESSION ID: AIR-F01 Modern Cyber Defense with Automated Real-Time Response: A Standards Update Bret Jordan Director of Security Architecture Symantec @jordan_bret Joe Brule Executive Director OpenC2 Forum
Monitoring Access to Shared Memory-Mapped Files
DIGITAL FORENSIC RESEARCH CONFERENCE Monitoring Access to Shared Memory-Mapped Files By Christian Sarmoria, Steve Chapin Presented At The Digital Forensic Research Conference DFRWS 2005 USA New Orleans,
Course Outline. CCNA Cyber Ops SECOPS Official Cert Guide (Course & Labs)
Course Outline CCNA Cyber Ops SECOPS 210-255 Official Cert Guide 23 Jul 2018 Contents 1. Course Objective 2. Pre-Assessment 3. Exercises, Quizzes, Flashcards & Glossary Number of Questions 4. Expert Instructor-Led
System for the Proactive, Continuous, and Efficient Collection of Digital Forensic Evidence
DIGITAL FORENSIC RESEARCH CONFERENCE System for the Proactive, Continuous, and Efficient Collection of Digital Forensic Evidence By Clay Shields, Ophir Frieder and Mark Maloof Presented At The Digital
Course Outline Topic 1: Current State Assessment, Security Operations Centers, and Security Architecture
About this Course This course will best position your organization to analyse threats and detect anomalies that could indicate cybercriminal behaviour. The payoff for this new proactive approach would
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner ACCREDITATIONS EXAM INFORMATION The Certified Digital Forensics Examiner exam is taken online through Mile2 s Assessment and Certification System ( MACS ), which is
A Study of User Data Integrity During Acquisition of Android Devices
DIGITAL FORENSIC RESEARCH CONFERENCE By Namheun Son, Yunho Lee, Dohyun Kim, Joshua I. James, Sangjin Lee and Kyungho Lee Presented At The Digital Forensic Research Conference DFRWS 2013 USA Monterey, CA
Cybersecurity Auditing in an Unsecure World
About This Course Cybersecurity Auditing in an Unsecure World Course Description $5.4 million that s the average cost of a data breach to a U.S.-based company. It s no surprise, then, that cybersecurity
CAT Detect: A Tool for Detecting Inconsistency in Computer Activity Timelines
DIGITAL FORENSIC RESEARCH CONFERENCE CAT Detect: A Tool for Detecting Inconsistency in Computer Activity Timelines By Andrew Marrington, Ibrahim Baggili, George Mohay and Andrew Clark Presented At The
SentinelOne Technical Brief
SentinelOne Technical Brief SentinelOne unifies prevention, detection and response in a fundamentally new approach to endpoint protection, driven by behavior-based threat detection and intelligent automation.
CNIT 121: Computer Forensics. 9 Network Evidence
CNIT 121: Computer Forensics 9 Network Evidence The Case for Network Monitoring Types of Network Monitoring Types of Network Monitoring Event-based alerts Snort, Suricata, SourceFire, RSA NetWitness Require
CUNY John Jay College of Criminal Justice MATH AND COMPUTER SCIENCE
Instructor: Prof Aftab Ahmad Office: NB 612 Telephone No. (212)393-6314 Email Address: aahmad@jjay.cuny.edu Office Hours: By appointment TEXT & REFERENCE MATERIAL Text Notes from instructor posted on Blackboard
The CASE standard can be used to represent all three of these categories throughout the electronic evidence lifecycle.
Using Standardization and Ontology to Enhance Data Protection and Intelligent Analysis of Electronic Evidence Eoghan Casey (University of Lausanne) 1 *, Maria Angela Biasiotti and Fabrizio Turchi (Institute
CIS 21 Final Study Guide. Final covers ch. 1-20, except for 17. Need to know:
CIS 21 Final Study Guide Final covers ch. 1-20, except for 17. Need to know: I. Amdahl's Law II. Moore s Law III. Processes and Threading A. What is a process? B. What is a thread? C. Modes (kernel mode,
Training for the cyber professionals of tomorrow
Hands-On Labs Training for the cyber professionals of tomorrow CYBRScore is a demonstrated leader in professional cyber security training. Our unique training approach utilizes immersive hands-on lab environments
Design Tradeoffs for Developing Fragmented Video Carving Tools
DIGITAL FORENSIC RESEARCH CONFERENCE Design Tradeoffs for Developing Fragmented Video Carving Tools By Eoghan Casey and Rikkert Zoun Presented At The Digital Forensic Research Conference DFRWS 2014 USA
2018 Cyber Mission Training Course Catalog
2018 Cyber Mission Training Catalog 7740 Milestone Parkway, Suite 150 Hanover, Maryland 21076 2018 copyrighted by the KeyW Corp. All rights reserved. KeyWCorp.com/cyber-mission-training TABLE OF CONTENTS
COMPUTER FORENSICS (CFRS)
Computer Forensics (CFRS) 1 COMPUTER FORENSICS (CFRS) 500 Level Courses CFRS 500: Introduction to Forensic Technology and Analysis. 3 credits. Presents an overview of technologies of interest to forensics
McAfee Network Security Platform Administration Course
McAfee Network Security Platform Administration Course Education Services administration course The McAfee Network Security Platform Administration course from McAfee Education Services is an essential
Enabling Distributed Threat Analysis: Common Attack Patterns and Malware Characterization
Enabling Distributed Threat Analysis: Common Attack Patterns and Malware Characterization Sean Barnum Penny Chase Aug 2011 HS SEDI is a trademark of the U.S. Department of Homeland Security (DHS). The
Incident Response & Forensic Best Practice. Cyber Attack!
Incident Response & Forensic Best Practice Cyber Attack! Overview Incident Response Forensic Requirement / Evidence Handling Investigative Steps Log Interpretation Advanced Correlation For Traceability
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner Course Title: Certified Digital Forensics Examiner Duration: 5 days Class Format Options: Instructor-led classroom Live Online Training Prerequisites: A minimum of
DESIGN AND IMPLEMENTATION OF A NETWORK FORENSICS SYSTEM FOR LINUX
DESIGN AND IMPLEMENTATION OF A NETWORK FORENSICS SYSTEM FOR LINUX Hong-Ming Wang National Kaohsiung Normal University Kaohsiung, Taiwan alexwang24@gmail.com Chung-Huang Yang National Kaohsiung Normal University
Hash Based Disk Imaging Using AFF4
DIGITAL FORENSIC RESEARCH CONFERENCE Hash Based Disk Imaging Using AFF4 By Michael Cohen and Bradley Schatz Presented At The Digital Forensic Research Conference DFRWS 2010 USA Portland, OR (Aug 2 nd -
Android Forensics: Automated Data Collection And Reporting From A Mobile Device
DIGITAL FORENSIC RESEARCH CONFERENCE Android Forensics: Automated Data Collection And Reporting From A Mobile Device By Justin Grover Presented At The Digital Forensic Research Conference DFRWS 2013 USA
Security+ SY0-501 Study Guide Table of Contents
Security+ SY0-501 Study Guide Table of Contents Course Introduction Table of Contents About This Course About CompTIA Certifications Module 1 / Threats, Attacks, and Vulnerabilities Module 1 / Unit 1 Indicators
SentinelOne Technical Brief
SentinelOne Technical Brief SentinelOne unifies prevention, detection and response in a fundamentally new approach to endpoint protection, driven by machine learning and intelligent automation. By rethinking
A Common Cyber Threat Framework: A Foundation for Communication
For For Public Distribution A Common Cyber Threat Framework: A Foundation for Communication This is a work of the U.S. Government and is not subject to copyright protection in the United States. Overview
Computer Forensics: Investigating Network Intrusions and Cybercrime, 2nd Edition. Chapter 2 Investigating Network Traffic
Computer Forensics: Investigating Network Intrusions and Cybercrime, 2nd Edition Chapter 2 Investigating Network Traffic Objectives After completing this chapter, you should be able to: Understand network
RSA INCIDENT RESPONSE SERVICES
RSA INCIDENT RESPONSE SERVICES Enabling early detection and rapid response EXECUTIVE SUMMARY Technical forensic analysis services RSA Incident Response services are for organizations that need rapid access
WHITEPAPER ATTIVO NETWORKS THREATDEFEND PLATFORM AND THE MITRE ATT&CK MATRIX
WHITEPAPER ATTIVO NETWORKS THREATDEFEND PLATFORM AND THE MITRE ATT&CK MATRIX 1 INTRODUCTION The MITRE Corporation Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK ) Matrix provides a model
Digital Forensics Readiness PREPARE BEFORE AN INCIDENT HAPPENS
Digital Forensics Readiness PREPARE BEFORE AN INCIDENT HAPPENS Digital Forensics Readiness: PREPARE BEFORE AN INCIDENT HAPPENS 2 Digital Forensics Readiness The idea that all networks can be compromised
BIG DATA ANALYTICS IN FORENSIC AUDIT. Presented in Mombasa. Uphold public interest
BIG DATA ANALYTICS IN FORENSIC AUDIT Presented in Mombasa Uphold public interest Nasumba Kwatukha Kizito CPA,CIA,CISA,CISI,CRMA,CISM,CISSP,CFE,IIK Internal Audit, Risk and Compliance Strathmore University
Can Digital Evidence Endure the Test of Time?
DIGITAL FORENSIC RESEARCH CONFERENCE By Michael Duren, Chet Hosmer Presented At The Digital Forensic Research Conference DFRWS 2002 USA Syracuse, NY (Aug 6 th - 9 th ) DFRWS is dedicated to the sharing
RSA INCIDENT RESPONSE SERVICES
RSA INCIDENT RESPONSE SERVICES Enabling early detection and rapid response EXECUTIVE SUMMARY Technical forensic analysis services RSA Incident Response services are for organizations that need rapid access
An Evaluation Platform for Forensic Memory Acquisition Software
DIGITAL FORENSIC RESEARCH CONFERENCE An Evaluation Platform for Forensic Memory Acquisition Software By Stefan Voemel and Johannes Stuttgen Presented At The Digital Forensic Research Conference DFRWS 2013
File Classification Using Sub-Sequence Kernels
DIGITAL FORENSIC RESEARCH CONFERENCE File Classification Using Sub-Sequence Kernels By Olivier DeVel Presented At The Digital Forensic Research Conference DFRWS 2003 USA Cleveland, OH (Aug 6 th - 8 th
CYBER ANALYTICS. Architecture Overview. Technical Brief. May 2016 novetta.com 2016, Novetta
CYBER ANALYTICS Architecture Overview Technical Brief May 2016 novetta.com 2016, Novetta Novetta Cyber Analytics: Technical Architecture Overview 1 INTRODUCTION 2 CAPTURE AND PROCESS ALL NETWORK TRAFFIC
Indicators of Compromise
Indicators of Compromise Effectively apply threat information Factsheet FS-2016-02 version 1.0 1 June 2017 If you are responsible for securing the network of your organisation, you will often hear the
Symantec Ransomware Protection
Symantec Ransomware Protection Protection Against Ransomware Defense in depth across all control points is required to stop ransomware @ Email Symantec Email Security.cloud, Symantec Messaging Gateway
Forensic and Log Analysis GUI
Forensic and Log Analysis GUI David Collett I am not representing my Employer April 2005 1 Introduction motivations and goals For sysadmins Agenda log analysis basic investigations, data recovery For forensics
ADVANCED FORENSICS COURSE
ADVANCED FORENSICS COURSE PRACTITIONER COURSE (3 DAYS) «Le cours de base présente les connaissances de bases relatives aux méthodes de recherche et d investigation des incidents, la gestion de l incident
Honeynets and Digital Forensics
DIGITAL FORENSIC RESEARCH CONFERENCE Honeynets and Digital Forensics By Lance Spitzner Presented At The Digital Forensic Research Conference DFRWS 2004 USA Baltimore, MD (Aug 11 th - 13 th ) DFRWS is dedicated
BinComp: A Stratified Approach to Compiler Provenance Attribution
DIGITAL FORENSIC RESEARCH CONFERENCE BinComp: A Stratified Approach to Compiler Provenance Attribution By Saed Alrabaee, Paria Shirani, Mourad Debbabi, Ashkan Rahimian and Lingyu Wang Presented At The
INCIDENT HANDLING & RESPONSE PROFESSIONAL VERSION 1
INCIDENT HANDLING & RESPONSE PROFESSIONAL VERSION 1 The most practical and comprehensive training course on incident handling & response elearnsecurity has been chosen by students in over 140 countries
STIX Profile Development Tutorial
STIX Profile Development Tutorial This tutorial describes how to create a STIX Profile step-by-step, with a particular focus on creating community profiles using the profile spreadsheet format with the
Assessing Your Incident Response Capabilities Do You Have What it Takes?
Assessing Your Incident Response Capabilities Do You Have What it Takes? March 31, 2017 Presenters Tim L. Bryan, CPA/CFF/CITP, CISA, EnCE Director, Advisory Services Forensic Technology & Investigation
SOLUTION BRIEF REMOTE ACCESS: WEBSHELLS SEE EVERYTHING, FEAR NOTHING
REMOTE ACCESS: WEBSHELLS SEE EVERYTHING, FEAR NOTHING RSA Visibility Reconnaissance Weaponization Delivery Exploitation Installation C2 Action WHAT IS A WEBSHELL? A WebShell is a piece of code or a script
What are we going to talk about today?
For those of you who haven t worked with me over the past 6 years, I m Bryan Senter. I ve been in Wiesbaden in a different role for 5 years. I followed the crowd from Heidelberg before that. EPMSaaS stands
Forensic Analysis Approach Based on Metadata and Hash Values for Digital Objects in the Cloud
Forensic Analysis Approach Based on Metadata and Hash Values for Digital Objects in the Cloud Ezz El-Din Hemdan 1, Manjaiah D.H 2 Research Scholar, Department of Computer Science, Mangalore University,
Digital Forensics Practicum CAINE 8.0. Review and User s Guide
Digital Forensics Practicum CAINE 8.0 Review and User s Guide Ana L. Hernandez Master of Science in Cybersecurity Digital Forensics Concentration University of South Florida 12-8-2017 Table of Contents
Blue Team Handbook: Incident Response Edition
Blue Team Handbook: Incident Response Edition A condensed field guide for the Cyber Security Incident Responder. By: Don Murdoch, GSE, MBA, CISSP+14 Version 2.0 1. Blue Team Handbook - Introduction 3 2.
Implementing Cisco Cybersecurity Operations
210-255 Implementing Cisco Cybersecurity Operations NWExam.com SUCCESS GUIDE TO CISCO CERTIFICATION Exam Summary Syllabus Questions Table of Contents Introduction to 210-255 Exam on Implementing Cisco
Ethical Hacking. Content Outline: Session 1
Ethical Hacking Content Outline: Session 1 Ethics & Hacking Hacking history : How it all begin - Why is security needed? - What is ethical hacking? - Ethical Hacker Vs Malicious hacker - Types of Hackers
Reducing the Cost of Incident Response
Reducing the Cost of Incident Response Introduction Cb Response is the most complete endpoint detection and response solution available to security teams who want a single platform for hunting threats,
THE DESIGN AND IMPLEMENTATION OF AN EXTENSIBLE FORMAT FORMEMORY DUMPS
THE DESIGN AND IMPLEMENTATION OF AN EXTENSIBLE FORMAT FORMEMORY DUMPS XIAOLU ZHANG, LIANG HU, ZHENZHEN XIE, SHINAN SONG, XIANGYU MENG, * KUO ZHAO Department of Computer Science and Technology, Jilin University,
Course 832 EC-Council Computer Hacking Forensic Investigator (CHFI)
Course 832 EC-Council Computer Hacking Forensic Investigator (CHFI) Duration: 5 days You Will Learn How To Understand how perimeter defenses work Scan and attack you own networks, without actually harming
Introduction to Computer Forensics
Introduction to Computer Forensics Subrahmani Babu Scientist- C, Computer Forensic Laboratory Indian Computer Emergency Response Team (CERT-In) Department of Information Technology, Govt of India. babu_sivakami@cert-in.org.in
Syllabus: The syllabus is broadly structured as follows:
Syllabus: The syllabus is broadly structured as follows: SR. NO. TOPICS SUBTOPICS 1 Foundations of Network Security Principles of Network Security Network Security Terminologies Network Security and Data
CRYPTTECH. Cost-effective log management for security and forensic analysis, ensuring compliance with mandates and storage regulations
Cost-effective log management for security and forensic analysis, ensuring compliance with mandates and storage regulations Integration with Numerous Type of Devices Flexible Architectural Configuration
New Model for Cyber Crime Investigation Procedure
New Model for Cyber Crime Investigation Procedure * *Dept. of IT & Cyber Police, Youngdong University, Rep. of Korea ydshin@youngdong.ac.kr doi:10.4156/jnit.vol2.issue2.1 Abstract In this paper, we presented
COMPUTER HACKING FORENSIC INVESTIGATOR (CHFI) V9
COMPUTER HACKING FORENSIC INVESTIGATOR (CHFI) V9 Course Code: 3401 Prepare for the CHFI certification while learning advanced forensics investigation techniques. EC-Council released the most advanced computer
Building Resilience in a Digital Enterprise
Building Resilience in a Digital Enterprise Top five steps to help reduce the risk of advanced targeted attacks To be successful in business today, an enterprise must operate securely in the cyberdomain.
RSA NetWitness Suite Respond in Minutes, Not Months
RSA NetWitness Suite Respond in Minutes, Not Months Overview One can hardly pick up a newspaper or turn on the news without hearing about the latest security breaches. The Verizon 2015 Data Breach Investigations
Digital Evidence Cabinets: A Proposed Framework for Handling Digital Chain of Custody
Digital Evidence Cabinets: A Proposed Framework for Handling Digital Chain of Custody Yudi Prayudi Department Of Informatics Universitas Islam Indonesia Yogyakarta Indonesia Ahmad Ashari Department Of
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Unauthorized Access
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
Cisco Networking Academy CCNA Cybersecurity Operations 1.1 Curriculum Overview Updated July 2018
Cisco Networking Academy CCNA Cybersecurity Operations 1.1 Curriculum Overview Updated July 2018 Cybersecurity Opportunities Cybercrime Costs Security Spending Cybersecurity Ventures: Cybersecurity Market
Visualization is pre-installed using open industry-standard data file formats: PCAP & IPFIX records open in WireShark. Log searches open as CSV files
CyberNUC is the perfect system for today s Cyber Analysts, Cyber-Hunters, and any other cybersecurity professional who needs to take all the functionality of a complete packet capture system into the field
Understanding Cisco Cybersecurity Fundamentals
210-250 Understanding Cisco Cybersecurity Fundamentals NWExam.com SUCCESS GUIDE TO CISCO CERTIFICATION Exam Summary Syllabus Questions Table of Contents Introduction to 210-250 Exam on Understanding Cisco
Course overview. CompTIA Security+ Certification (Exam SY0-501) Study Guide (G635eng v107)
Overview This course is intended for those wishing to qualify with CompTIA Security+. CompTIA's Security+ Certification is a foundation-level certificate designed for IT administrators with 2 years' experience
Qualys Indication of Compromise
18 QUALYS SECURITY CONFERENCE 2018 Qualys Indication of Compromise Bringing IOC to the Next Level Chris Carlson VP, Product Management, Qualys, Inc. Adversary TTPs are Changing Early 2010s Zero-day Vulnerabilities
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM
SOLUTION BRIEF RSA NETWITNESS SUITE 3X THE IMPACT WITH YOUR EXISTING SECURITY TEAM OVERVIEW The Verizon 2016 Data Breach Investigations Report highlights that attackers are regularly outpacing the defenders.
Digital Forensics Lecture 01- Disk Forensics
Digital Forensics Lecture 01- Disk Forensics An Introduction to Akbar S. Namin Texas Tech University Spring 2017 Digital Investigations and Evidence Investigation of some type of digital device that has
Designing and Building a Cybersecurity Program
Designing and Building a Cybersecurity Program Based on the NIST Cybersecurity Framework (CSF) Larry Wilson lwilson@umassp.edu ISACA Breakfast Meeting January, 2016 Designing & Building a Cybersecurity
Source: https://articles.forensicfocus.com/2018/03/02/evidence-acquisition-using-accessdata-ftk-imager/
by Chirath De Alwis Source: https://articles.forensicfocus.com/2018/03/02/evidence-acquisition-using-accessdata-ftk-imager/ Forensic Toolkit or FTK is a computer forensics software product made by AccessData.