Table of Contents for

System Forensics, Investigation, and Response, 3rd Edition

An event is any observable occurrence within a system or network. This includes any activity on the network, such as when a user accesses files on a server or when a firewall blocks network traffic. Adverse events are events with negative results or negative consequences. Attacks on systems are adverse events. Adverse events discussed here are events that are computer-security related. They are not events caused by sources such as natural disasters and power failures. A computer security incident is any event that violates an organization’s security policies. This includes computer security policies, acceptable use policies, or standard security practices. The following are examples of computer security incidents:

• Denial of service (DoS) attacks—A DoS attack could result from an attacker sending specially crafted packets to a web server that cause it to crash. It could also result from an attacker directing hundreds of compromised external workstations to send many Internet Control Message Protocol (ICMP) requests to an organization’s network. When the attack comes simultaneously from multiple coordinated sources, it is referred to as a distributed DoS (DDoS) attack.

• Malicious code—Malicious software, or malware, is any malicious code, such as viruses, worms, and Trojans. For example, a worm uses open file shares to quickly infect hundreds of systems in an organization. An employee may innocently introduce viruses into a network from his or her home computer on a USB thumb drive. When the employee plugs the USB drive into the work computer, the virus infects the work computer and, subsequently, can infect the entire work network.

• Unauthorized access—This includes any time someone accesses files he or she is not specifically authorized to access. The person gaining access can be someone within the organization, such as an employee or contractor, or an external attacker. If shared files are not locked down with appropriate permissions, users may stumble upon data they shouldn’t see. If databases used by web servers are not secure, attackers may be able to access sensitive customer data, such as credit card information, from anywhere on the Internet.

• Inappropriate usage—Inappropriate usage could take a number of forms. For example, a user might provide illegal copies of software to others through peer-to-peer (P2P) file-sharing services. This same P2P software could cause data leakage resulting in private data from the user’s computer being shared on the Internet to anyone else using the same P2P software. Another example is if a person threatens another person through email.

Regardless of the specifics of the incident, it is critical that the evidence be preserved. However, this topic takes on a new perspective in the case of incident response. The usual emphasis for corporate disaster recovery is simply a return to normal operations as soon as possible. Frequently, this is done at the expense of preserving forensic evidence. This can lead to many problems.

First and foremost, failure to preserve forensic information will prevent the IT team from effectively evaluating the cause of the incident and adjusting company policies and procedures to reduce the risk of such an incident being repeated. Even if the incident does not involve a crime, or the company simply does not desire to prosecute, forensic data is an integral part of preventing future incidents.

There are also situations in which the organization may not have initially thought a crime was committed, but further investigation reveals that a criminal act did occur. For example, a hard drive crash might initially be thought to be a normal failure of the device, but further examination uncovers malware that caused the hard drive to fail much sooner than it should have. If proper forensic procedures have not been followed, it may be impossible to prosecute or pursue civil litigation.