Hands-On Security in DevOps

Incident forensics techniques

The primary objective of incident forensics for an organization is to answer the following questions:

• Is the host infected with a malicious program?
• How did the host get infected?
• What can be improved to avoid the infection?

The NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response defines four major phases to perform digital forensics on a compromised computer:

• Collection: Collect all the relevant logs of the compromised computer or networking activities logs
• Examination: Extract and correlate the information that may highly relate to suspicious behaviors
• Analysis: Analyze all the information for root causes of the malicious infection
• Reporting: Conclude the summary results

The ...