INCIDENT RESPONSE &ndash INVESTIGATING COMPUTER CRIME (Catlett, VA)

INCIDENT RESPONSE &ndash INVESTIGATING COMPUTER CRIME

condition excellentLocal pick-up preferred but will ship at the buyer s expense Kingston Books 13 IMG_4700 Author s Kevin Mandia and Chris Prosise Publisher Osborne McGraw Hill Illustrated Screen Shots Note This was a college text book. Some passages are Hi-Lited with a yellow marker. This is one of the first books available that explains what to do after you ve been hacked. Written by FBI insiders this book reveals the computer forensics process and offers authoritative solutions designed to counteract and conquer hacker attacks. At A GLANCE Part 1. Learning the Ropes Insiders and Outsiders A Case Study Introduction to Incident Response Preparing for Incident Response Part 2. Putting on the Gloves Investigative Guidelines The Computer Forensic Process Learning network Protocols and Performing a Trap and Trace Performing Network Surveillance Advanced Network Surveillance Part 3. Getting into the Ring Investigating Systems Initial Response to Windows NT 2000 Investigating Windows NT 2000 Initial Response to UNIX Systems Investigating UNIX Part 4. Investigating Nonplatform Specific Technology Investigating Routers Investigating WEB Attacks Investigating Application Servers Investigating Hacker Tools Part 5. Appendixes A. Establishing Identity in Cyberspace B. Information Security Policies and Acceptable Use Policies C. Computer Crime Statutes D. Response Organizations Index Contents by Chapter Acknowledgements Foreword Introduction Part I Learning the Ropes 1. Insiders and Outsiders A Case Study Deterring Attacks Real Insiders The Information Obtained Pursuant to a 18 U.S.C. 2703 Court Order So What 2. Introduction to Incident Response Goals of Incident Response Incident Response Methodology Pre-incident Response Preperation Detection of Incidents Initial Response Response Strategy Formulation Deciding on Your Response Strategy Presenting Response Strategy Options to Management Forensic Duplication Investigation Security Measure Implementation Network Monitoring Deciding Where and How to Monitor Deciding What to Monitor Recovery Considering What Was Compromised Choosing a Recovery Strategy Reporting So What 3. Preparing for Incident Response Identifying Your Vital Assets Preparing Individual Hosts Recording Cryptographic Checksums of Critical Files Increasing or Enabling Secure Audit Logging Building up your Host s Defenses Backing Up Critical Data Educating Your Users about Host-Based Security Preparing a Network Installing Firewalls and Intrusion Detection Systems Using Access Control Lists on Your Routers Creating a Network Topology Conductive to Monitoring Encrypting Network Traffic Requiring Authentication Establishing Appropriate Policies and Procedures Determining Your Response Stance Understanding How Policies Can Aid Investigative Steps Developing Acceptable Use Policies (AUPs) Designing AUP s Developing Incident Response Procedures Creating a Response Toolkit The Response Hardware The Response Software The Network Monitoring Platform Establishing an Incident Response Team Deciding on the Team s Mission Getting the Team Together Incident Response Training and Professional Organizations So What Part II Putting On the Gloves 4. Investigative Guidelines Conducting an Initial Assessment Asking Questions during Incident Notification Incident Notification Checklist Examining Network Topology Verifying Policies Investigating the Incident Conducting Personal Interviews Taking Hands-On Actions Formulating Response Strategy Determining the Appropriate Type of Response Determining the Type of Attack Classifying the Victim System Considering Other Influences Obtaining Management Approval So What 5. The Computer Forensic Process Learning to Handle Evidence Common Mistakes in Evidence Handling The Best Evidence Rule The Chain of Custody Performing and Initial Response Volatile Data Live System Review Performing Forensic Duplication Forensic Duplication Approaches Verifying Low-Level System Configuration Forensic Duplication Tools Using Safeback Creating a DOS Controlled Boot Copy Creating the Forensic Duplication with Safeback Using UNIX Utilities for Forensic Duplication Creating a UNIX-Controlled Boot Disk Creating the Forensic Image with DD Using EnCase Creating Evidence Files with EnCase Using EnCase to Preview Evidence Drives Performing Forensic Analysis Conducting Physical Analysis Logical Analysis Understanding Where Evidence Resides So What 6. Learning Network Protocols and Performing a Trap and Trace Understanding TCP IP Encapsulation The IP Header The TCP Header The UDP Header Using Sniffers Performing a Trap and Trace Creating Output Files So What 7. Performing Network Surveillance Why Perform Network Surveillance Network-Based Evidence Maintaining the Chain of Custody Network Forensics The Challenge of Network Forensics Setting Up Your System Determining Goals Check with Legal Counsel Choose Appropriate Hardware Choose Appropriate Software Location and Security of the Monitor Performing Surveillance Monitoring telnet Monitoring the File Transfer Protocol Monitoring WEB Traffic Interpreting a Network Attack So What 8. Advanced Network Surveillance The Elite Attacker s Goals Activities That Usually Are Not Monitored Activities That Are Difficult to Detect Activities That are Difficult Play Back Attacks That Are Difficult to Trace Back to the Source IP Address Making Evidence Collection as Difficult as Possible Maintaining Plausible Deniability ICMP Covert Channeling Examining Ping Traffic Recognizing Loki Covert Channeling Recognizing the Next Generation of ICMP Covert Channeling Stateless TCP Covert Channeling Examining a Stateless TCP Session Recognizing Stateless TCP Covert Channeling HTTP Covert Channeling Detecting Illicit Servers So What Part III Getting into the Ring Investigating Systems 9. Initial Response to Windows NT 2000 Creating a Response Toolkit Toolkit labels Toolkit Contents Storing Information Obtained During the Initial Response Obtaining Volatile Data Prior to Forensic Duplication Organizing and Documenting Your Investigation Executing a Trusted cmd.exe Determining Who is Logged into the System Determining Open Ports and Listening Applications Listing All Running Processes Listing Current and Recent Connections Documenting the Commands Used During Initial Response Scripting Your Initial Response Performing an In-Depth Live Response Obtaining Event Logs During Live Response Reviewing the Registry During a Live Response Obtaining Modification Creation and Access Times of All Files Obtaining System Passwords Dumping System RAM Is Forensic Duplication Necessary So What 10. Investigating Windows NT 2000 Where Evidence Resides on Windows NT 2000 Systems Setting Up a Forensic Workstation Reviewing Logical Files Handling Passwords Performing Initial Low-Level Analysis Conducting a Windows NT 2000 Investigation Reviewing All Pertinent Logs Performing Keyword Searches Reviewing Relevant Files Identifying Unauthorized User Accounts or Groups Identifying Rogue Processes Looking for Unusual or Hidden Files Checking for Unauthorized Access Points Examining Jobs Run by the Scheduler Service Analyzing Trust Relationships Reviewing the Security Identifiers (SIDs) File Auditing and Theft of Information Handling the Departing Employee Reviewing Searches and Files Used Conducting String Searches on Hard Drives So What 11. Initial Responses to UNIX Systems Creating a Response Toolkit Storing Information Obtained During the Initial Response Obtaining Volatile Data Prior to Forensic Duplication Executing a Trusted Shell Determining Who is Logged on to the System Determining the Running Processes Detecting Loadable Kernel Module Rootkits Determining Open Ports and Listening Applications Reviewing the Proc File System Cleaning Up Your Tracks Performing an In-Depth Live Response Obtaining Modification Creation and Access Times of All Files Obtaining the System Logs During Live Response Obtaining Important Configuration Files Dumping System RAM So What 12. Investigating UNIX Preparing to Review a Restored Image Booting Into the Native Operating System Performing Initial Low-Level Analysis Conducting a UNIX Investigation Reviewing Pertinent Logs Performing Keyword Searches Reviewing Relevant Files Identifying Unauthorized User Accounts or Groups Identifying Rogue Processes Checking for Unauthorized Access Points Analyzing Trust Relationships So What Part IV Investigating NonPlatform-Specific Technology 13 Investigating Routers Obtaining Volatile Data Prior to Powering Down Establishing a Router Connection Recording System Time Determining Who is Logged On Determining the Router s Uptime Determining Listening Socket s Saving the Router Configuration Reviewing the Router Table Checking Interface Configurations Viewing the ARP Cache Finding the Proof Handling Direct Compromise Incidents Handling Routing Table Manipulation Incidents Handling Theft of Information Incidents Handling Denial-of-Service Attacks Using Routers as Response Tools Understanding Access Control Lists Monitoring With Routers Responding o DDos Attacks So What 14. Investigating WEB Attacks Before You Power Down Finding the Proof Investigating Log Files Investigating WEB Site Defacement Investigating Application-Level Attacks Determining the Source of Attacks So What 15. Investigating Application Servers Investigating Domain Name server Incidents Handling Direct Attacks Investigating Cache Corruption Investigating FTP Server Incidents Handling Direct Compromise Incidents Investigating File-Storage Abuse Investigating RPC Service Incidents Using Online Chat Program Records to Investigate Incidents Handling Incidents Involving Microsoft Office Finding Clues in Office Documents Decrypting Office Documents Determining the Source of Application Attacks Recovering Compromised Application Servers So What 16. Investigating Hacker Tools How Files are Compiled Statically Linked Programs Dynamically Linked Programs Programs Compiled with Debug Options Stripped Programs Programs Packed with UPX Static Analysis of a Hacker Tool Determining the Type of File Reviewing the ASCII and UNICODE Strings Performing Online Research Performing Source Code Review Dynamic Analysis of a Hacker Tool Creating the Sandbox Environment Dynamic Analysis on a UNIX Ststem Dynamic Analysis on A Windows System So What Part V Appendixes A. Establishing Identity in Cyberspace Investigating IP Addresses Using nslookup Using Traceroute or Tracert Using Whois Database Investigating Dynamic IP Addresses Investigating MAC Addresses Tracing E-mail Tracing a Fakemail Tracing Back Web-based E-mail Investigating E-mail Addresses Nicknames Usernames and Hostnames Piercing Anonymity through Legal Channels Filing John Doe Lawsuits Reporting an Incident to Law Enforcement B. Information Security Policies and Acceptable Use Policies Information Security Policy Areas Acceptable Use Policies Sample Acceptable Use Policy C. Computer Crime Statutes Federal Computer Intrusion Laws Federal Intellectual Property Laws Copyright Offenses Copyright Management Offenses Bootlegging Offenses Trademark Offenses Trade Secret Offenses Offenses Relating to the Integrity of IP Systems Offenses Relating to the Misuse of Dissemination Systems Commerce and Trade Laws E. Response Organizations Index Paperback 509 pages ISBN 0-07-213182-9