Post-incident device forensics

As part of an investigation process, system-level investigation may lead you to one or more devices (for example, sensor, actuator, gateway, or other server), and therefore a thorough forensic examination of the compromised device is in order to try to determine the characteristics of the attacker.

You may find specific files loaded or modified by the attacker, or in some cases it may be possible to lift fingerprints from the device itself. Device analysis of device gateways may involve components located at the network edge, or centrally within a CSP (for example, a virtualized system).

Typically, a response team would capture images of the compromised systems for offline evaluation. This is where infrastructure ...

Get Practical Internet of Things Security - Second Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.