Upload File

hunt and incident response team (hirt)...proactive hunt incident response a search for malicious...

  • Home
  • Documents
  • HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,
16
HUNT AND INCIDENT RESPONSE TEAM (HIRT) National Cybersecurity & Communications Integration Center (NCCIC) Benjamin Loader Deputy Chief, Incident Management Group NCCIC Hunt and Incident Response Team (HIRT)

Upload: others

Post on 19-Jul-2020

1 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

HUNT AND INCIDENT RESPONSE TEAM (HIRT)

National Cybersecurity & Communications Integration Center (NCCIC)

Benjamin LoaderDeputy Chief, Incident Management GroupNCCIC Hunt and Incident Response Team (HIRT)

Page 2: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED2

Page 3: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED

WHO AM I?• Benjamin Loader

• Deputy Chief, Incident Manage Group• NCCIC Hunt and Incident Response Team (HIRT)

• More than 11 years of operational and strategic experience• Intelligence and Cyber Analyst• Army Veteran• Teacher and mentor• Boater and diver

Page 4: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED

WHY AM I HERE?

• To talk about who we (HIRT) are• Dive into discussion about incident reponse

Page 5: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED

Agenda

HIRT Overview

HIRT Service Offerings

Proactive Hunt vs. Incident Response

Incident Response Lifecycle

Prioritizing Incidents

Engagement Types

Engagement Workflow

How to Contact HIRT

Page 6: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED 6

Hunt & IncidentResponse Team(HIRT)

The National Cybersecurity Communications and Integration Center (NCCIC) Hunt and Incident Response Team (HIRT) provides expert intrusion analysis and mitigation guidance to clients who lack the in-house capability or require additional assistance with responding to a cyber incident.

HIRT’s clients include: Uniquely positioned to provide comprehensive analysis

Federal departments and agencies

State, Local, Tribal and Territorial (SLTT) governments

Private Sector (Industry & Critical Infrastructure)

Academia

International Organizations

Classified and unclassified tactics, techniques and procedures (tips)

Public and private sector partners

Established relationships with Law Enforcement, Intelligence Community and International Partners

Page 7: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED

HIRT Service Offerings

ü Incident Triage ü Hunt Analysis

ü Network Topology Review ü Mitigation

ü Infrastructure Configuration Review ü Malware Analysis

ü Log Analysis ü Digital Media Analysis

ü Incident Specific Risk Overview ü Control System Incident Analysis

Page 8: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED

Proactive Hunt Incident Response

A search for malicious activity through the examination of a network environment for exploitation tools, tactics, procedures, and associated artifacts

An asset owner-driven request

Uses a risk review to scope the breadth of the Proactive Hunt

If malicious activity is observed during a hunt, move to Incident Response

HIRT takes action to respond to a reported incident and to address the increased risks generated by the incident

Asset owners and trusted third parties report information to NCCIC.

Trusted reporters include FBI, Information Sharing and Analysis Centers (ISACs), and other government agencies

Uses a risk review to scope the breadth of the Incident Response

Page 9: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED

HIRT Incident Response Lifecycle

Page 10: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED

NCISS Solution

Based on NIST 800-61 Revision 2• Functional Impact• Information Impact• Recoverability• Adds Actor Characterization• Adds Observed Activity• Adds Location of Observed Activity• Adds Cross Sector Dependency• Adds Potential Impact

NCCIC Cyber Incident Scoring System (NCISS)

Uses a weighted average (math) of the above criteria for a repeatable process

Page 11: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED

Engagement Types

Remote Assistance Providing assistance without being physically onsite

Advisory Deployment Advising for mitigation onsite but technical analysis capabilities not deployed

Remote Deployment Deploying Equipment, remotely conducting analysis

Onsite Deployment Deployment of equipment and personal onsite to conduct technical analysis

Page 12: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED

Incident Response Workflow

Page 13: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED

Onsite Deployment Team Composition

Page 14: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED

Engagement Timeline

Page 15: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

UNCLASSIFIED

How to Contact NCCIC for Hunt and Incident Response Services

OPERATIONS

Email: [email protected]

Phone: 888-282-0870

Page 16: HUNT AND INCIDENT RESPONSE TEAM (HIRT)...Proactive Hunt Incident Response A search for malicious activity through the examination of a network environment for exploitation tools, tactics,

Exam information - Universitetet i oslo · Incident response is a reaction to unexpected events. Incident response shall reduce negative consequences of an incident. As incident response

Communication Strategies for Incident Response - · PDF fileEffective incident response requires more than notification technologies. Real-time collaboration among incident response

Lesson 11 Basics of Incident Response. UTSA IS 3523 ID and Incident Response Overview Hacker Lexicon Incident Response

Cyber Hunt RFQ.…  · Web viewHighly Adaptive Cybersecurity Services (HACS) Penetration Testing, Incident Response, Cyber Hunt, and Risk and Vulnerability Assessment . Request for

Incident Response Plan - Spearstonespearstone.com/resources/Breach_Response_Plan_by_AICPA.pdf · 4 Table of Contents Incident Response Plan 6 Incident Response Team 6 Incident Response

POLLUTION INCIDENT RESPONSE MANAGEMENT PLAN FOR …danielsinternational.com.au/.../pollution-incident-response-plan.pdf · CONFIDENTIAL & PROPRIETARY | POLLUTION INCIDENT RESPONSE

Incident Response

Be Prepared: Incident Response and Business Continuity ... · Incident Response and Business Continuity —What These Are Incident response management Ensure proper management response

Lesson 5 Introduction to Incident Response. UTSA IS 6353 Incident Response Overview Hacker Lexicon Incident Response

TRAUMATIC INCIDENT RESPONSE PROGRAM …Traumatic Incident Response Program Manual March 2014 2 SECU State Employees' Credit Union TIR Traumatic Incident Response TIRC Traumatic Incident

CrowdStrike Services CROWDSTRIKE INCIDENT RESPONSE AND PROACTIVE …€¦ · CrowdStrike Incident Response & Proactive Services. 01 AM I BREACHED? INCIDENT RESPONSE The CrowdStrike

RSA Incident Response: Emerging Threat Profile€¦ · RSA Incident Response incident response RSA Incident Response: Emerging Threat Profile . Shell_Crew . January 2014

Lesson 6 Basics of Incident Response. UTSA IS 6353 Security Incident Response Overview Hacker Lexicon Incident Response

and Incident Response Enabling effective Hunt Teaming€¦ · Enabling effective Hunt Teaming and Incident Response (with zero budget and limited time) whoami Jeff McJunkin, Senior

Business Resilience & Incident Response Are You Ready? · Resilience & Incident Response ... Business Resilience & Incident Response ... Business Resilience & Incident Response Are

Incident Response Preparedness: Best Practices - lba.org Crocker - Incident Response - Are... · Sr. Incident Response Consultant, Incident Response & Digital Forensics . SecureWorks

Incident Response and Forensic Prepardness - ACUIA.org - Incident Response... · Incident Response and Forensic Preparedness ... and intrusion detection and antivirus products

Lasalocid Response 2014 Incident Management Response John Buchweitz, MSU DCPAH Lisa Joseph, FDA Nancy Barr, MDARD April Hunt, MDARD Tim Lyons, MDARD

Incident response: Introduction

Digital Forensics, Incident Response, and Cloud Computing · Digital Forensics, Incident Response, and Cloud ... •Cloud-ready incident response and forensics: ... forensics-incident-response-summit-jesse-kornblum-computer

Cyber incident response - KPMG · the incident response programme. Incident response programme development • Assistance in creation of an incident response programme, process design

Professional incident response

Incident response cloud

LCG Incident Response

Tanium Incident Response Overview Tanium Incident ResponseTM · 2016-12-01 · Tanium Incident Response delivers a broad set of capabilities to hunt, ... information on the state

Incident Totals Incident Type Response per District

Incident Response Incident Response Process Forensics

How to Response Against Web Security Incident...Agenda Incident Response Life Cycle Recap Incident Response Web Hacking PlayBook Incident Response Step for Web Hacking Security Incident

Incident Response Policy

Enterprise Incident Response - Cisco · Enterprise Incident Response: ... Case Study 2: Removable Media. ... • Full-scope incident response, analysis, and investigation

Improving Incident Response Incident Response Agenda Why Incident Response is Important Threats, Numbers, Traditional Response What is an Incident

California-Joint Cyber Incident Response Guide Cyber Incident...Feb 27, 2018  · Incident Response Lifecycle A security incident response capability will be developed and implemented

Anti Incident Response

Enabling effective hunt teaming and incident response

1. Incident Response System Modelling...2 1. Incident Response System Modelling The Incident Response (IR) subsystem is responsible for handling any incident message and providing