* Tips for gathering information after a security breach
In this continuing series of articles on Computer Incident Response Teams I am reviewing principles and practical pointers for effective response to security breaches and other operational difficulties in IT management. Today I’m focusing on critical distinctions that your CIRT members should keep in mind.
From my experience running technical support and operations over the years, I believe that the same principles that underlie effective technical support equally inform effective CIRT management.
GET THE GLOBAL PICTURE
When gathering information about an incident, staff members should establish a clear picture of what people were doing when they realized that there was a problem. For example, it may be important to know that someone was accessing a rarely used account and noticed that a file was not available because someone else had it open. Those details will help to characterize the attack and to provide clues that may lead to additional valuable data. However, my approach would include asking why my contact was accessing the rarely used account; it takes only a minute, but getting a wider picture may give the analyst another perspective that can also lead to new clues. In the scenario I have sketched, one could imagine that a system administrator had become curious about some unexpected resource utilization in a supposedly dormant account. This simple fact might lead to additional exploration of system log files and questions about whether any other dormant accounts had sparked curiosity. So, in general, it is worth your while to explore the situation more broadly at first rather than driving down the very first avenue that presents itself in the initial questions.
DISTINGUISH OBSERVATION FROM ASSUMPTION
As the CIRT member listens to the observations of other staff members, it is critically important to distinguish facts – that is, personal observations – from assumptions. Assumptions are ideas taken for granted or statements that are accepted without proof. For example, imagine the serious consequences of hearing someone say, “And so then they exploited a flaw in the firewall and then they…” and simply writing that statement down as if it were a fact. Such an assumption could profoundly distort the investigation, putting people’s efforts into the wrong track and diverting their attention from a more fruitful line of inquiry. Hearing such a statement, I would write down, “And so perhaps they exploited a flaw in the firewall….”
DISTINGUISH OBSERVATION FROM HEARSAY
Everyone has played the child’s game of whispering a sentence to another person and then hearing the distorted version that come out the other end of a long chain of transmission without error correction. CIRT staff must always distinguish between first-person observations (“I read the log file and found…”) and hearsay (“Shalama read the log file and she found…”). Don’t trust hearsay: check it out yourself by tracking down the source of the information.
More in the next article.
