Three Capabilities, Three Companies

Recently I've been working to augment my team's detection and response capabilities. I've identified three functions for which I've turned to cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 commercial software community for assistance. I'd like to highlight three capabilities and three companies which may be able to meet my requirements.

First, I need high-end network forensics. I plan to use my open source tools to do a good deal of collection and some analysis, but in certain cases I need more content-centric capabilities. For example, it would not be easy for me to extract certain types of application layer content (think documents, email attachments, and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 like) using some of my tools. I am also not cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 only person who may need to do this work, so a collaboration- and non-expert-friendly system is needed.

For this I am taking a close look at NetWitness NextGen. I recently bought a copy of Investigator Field Edition. You can think of this product as a network forensics-equivalent of a hard drive forensics product. It's content-centric, not packet-centric like Wireshark. I'm considering using NetWitness Informer to provide Tactical Traffic Assessment services to my businesses by periodically collecting traffic and reporting on what I find.

I can't deploy network sensors everywhere I have a victim host. Therefore, I am going to end up doing a lot of host-centric detection and response. When I suspect a host has been compromised, I want to be able to remotely access that host, collect live response data, and perhaps remotely image cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 hard drive. I need to know as much about cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 victim as I can, as quickly as possible.

To meet this requirement I am considering MANDIANT Intelligent Response. I visited cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir Alexandria, VA offices and got a look at cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 product. I like cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 fact that it is built to not only support customers, but also for cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 MANDIANT consultants supporting DoD and ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r companies like mine. The consultants feed design ideas to cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 developers, and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 team I met was open to my suggestions. I've also worked with many of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 MANDIANT group and I believe cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y know what is needed to win incident response engagements. MANDIANT's product supports collaboration by allowing multiple investigators to research cases remotely. Their appliance has plenty of storage (3 TB I believe) to house remotely imaged hard drives as well.

The third capability I need to augment involves runtime and binary forensics, also known as memory forensics. Going one step beyond cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 need to conduct live response, I want to take a snapshot of memory on a victim. I want to identify rogue processes, and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n 1) retrieve those processes in binary form for static and dynamic analysis on a test box and/or 2) attach a debugger to cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 rogue process to learn more about it in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 wild. The first case is helpful to determine how malware could be used and how it is like to communicate with cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 outside world. The second case could be used to observe malware in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 wild, possibly even monitoring its communications with its controller -- even if those communications are encrypted on cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 wire.

To meet this last requirement I met today with HBGary and looked at a beta of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir new HBGary Responder product. Over cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 next few months cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y are going to add cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 capability to remotely push cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir agent to a victim and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365n pull data from cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 victim to a concentrator. They plan to add collaboration features (similar to MANDIANT's) so I could manage cases in a distributed manner. Their Responder product provides Active Reversing capability and integrates cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 pure reverse engineering power of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir Inspector tool. I was impressed by Responder's graphing capabilities and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 way it showed areas of code that might interest me.

In addition to my technical detection and response needs, I also must provide security metrics for my program. It should be clear after reading such wonderfully titled posts as Control-Compliant vs Field-Assessed Security that I think input metrics are overrated. I need more output metrics to estimate cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 score of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 game, i.e., are we winning, drawing, or losing? I am considering using HBGary Responder to provide one of our metrics in cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 following manner.

1. Select a random subset of assets, like employee laptops.


2. Use HBGary Responder to collect memory images of cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365se assets.


3. Use cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 product's binary hashing capabilities to identify processes by comparing cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365m to cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Bit9 Knowledgebase and ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r lists.


4. Count cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 number of normal, suspicious, and malicious results over time, per machine. Ideally we want to see fewer suspicious and malicious results, with higher numbers indicating problems.


5. Beyond cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 metric, use cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 conclusions to conduct incident response for those suspicious and malicious results.

I generated a bunch of ocá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365r metrics last year in Controls Are Not cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Solution to Our Problem.
Incidentally, I'm not cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 only person to think cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365se companies are offering something worthwhile. Today I read Analyze This Malware over at Dark Reading.

Application forensics is a final category of importance for which cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365re are no real commercial tools yet. The canonical example is database forensics. The Oracle leader is (unsurprisingly!) David Litchfield and cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 SQL server leader is Kevvie Fowler. Both should have books on cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365ir respective subjects arriving this year.