Cyber Security Incident Response Process Complete Guideline 

NIST Incident Response Steps -

Step  1:  Preparation

Step  2:  Detection and Analysis

Step  3:  Containment, Eradication and Recovery

Step  4:  Post-Incident Activity

Preparation:

Preparation is the key to effective incident response. Even the best incident response team cannot effectively address an incident without predetermined guidelines. In order to successfully address security events, these features should be included in an incident response plan:

Develop and Document IR Policies: Establish policies, procedures, and agreements for incident response management.

Define Communication Guidelines: Create communication standards and guidelines to enable seamless communication during and after an incident.

Incorporate Threat Intelligence Feeds: Perform ongoing collection, analysis, and synchronization of your threat intelligence feeds.

Conduct Cyber Hunting Exercises: Conduct operational threat hunting exercises to find incidents occurring within your environment. This allows for more proactive incident response.

Assess Your Threat Detection Capability: Assess your current threat detection capability and update risk assessment and improvement programs.

It includes plan, procedures , SOP (Standard Operating Procedures including real time example/scenario with resolution steps), Communication protocol and escalation matrix.

Detection and Analysis:

The focus of this phase is to monitor security events in order to detect, alert, and report on potential security incidents.

Monitor security events in your environment using firewalls, intrusion prevention systems, and data loss prevention.

Detect potential security incidents by correlating alerts within a SIEM solution.

Triage and Analysis including (a) Endpoint Analysis (b) Binary Analysis (c) log/event analysis

It also includes system responses, digital forensics, memory analysis, and malware analysis.

Containment, Eradication and Recovery:

Containment refers to stop the spreading , Isolate the affected system immediately.

Start recovery to apply temporary/adhoc fix , Finally test it to deploy the fix into production 

Post-Incident Activity:

Post recovery start collecting all the artifact and chronology with the incident  

1.   How the issue was identified  (i,e - through SIEM Solution, IDS alert..etc) ?

 2.    What time incident occurs? and how its reported ?

 3.    What time issue resolved ?

 4.    What are the steps taken ? 

 5.    Update SOP based on the case 

 6.    Track and follow-up actions.

Few things keep in mind cyber security incident response communication must be restricted and confidential unless its genuine case, Otherwise it could impact company reputation.

However most of the organization SOC ( Security Operation Centre ) team and Incident response team work hand to hand to resolve the issue.

Digital Forensics 

There are many functionality can see in left side panel of Autopsy tool, Its depend on your case and investigation you are doing

Once we have collected the data and start investigating. Few things can be consider during investigation :

a) Recent activity - Try to corelate with your case : what time issue happened? Who modify the file ? ..etc

b) In Autopsy you can see "Deleted files "and their Hashes (SHA) and MD5 which is very important to check file integrity .

Chain Of Custody :  One of the important concept for digital forensics, Example : Any case going to legal/court proceedings chain of custody capture all the artifact /evidence with chronology ( To present the legal case in court tool is used to perform digital forensics should be performed with licensed tool and its good to have person investigated the case is ECIH certified, However its depend on the case )

Digital Forensics related few important point : 

• If new data overwrites that old data, the old data is no longer recoverable.

• Yes. It is possible to recover data by forensics even if you delete or wipe the contents using the most sophisticated technology available in the market.

• Determine if a file has changed - Stochastic forensics method can be used to identify this 

Various kinds of techniques are used in computer forensics investigation such as:

·   

•  Stochastic forensics:  It is a method to forensically re-establish the digital activities that have insufficient digital artifacts, thus analyzing emerging patterns resulting from the stochastic nature of modern-day computers.

•  Steganography: Reverse Steganography is a technique of hiding the secret information inside or on top of something, that something  can be anything from an image to any type o file.

• Cross-drive analysis:  Cross-drive analysis (CDA) is a technique that allows an investigator to quickly identify and correlate information from multiple data sources or information across multiple drives.

•  Live analysis: It is used to examine the computers from within the OS using various forensics. This approach is useful in the case where the investigator is dealing with encrypted files. Which TCP and UDP ports are open, what services are currently in use, and running, etc.

• Deleted files recovery: It is a technique that is used to recover deleted files. The deleted data can be recovered or craved out using forensic tools such as CrashPlan, OnTrack EasyRecovery, Wise Data Recovery, etc.

Malware is any software used to gain unauthorized access to IT systems in order to steal data, disrupt system services or damage IT networks in any way. Ransomware is a type of malware identified by specified data or systems being held captive by attackers until a form of payment or ransom is provided.

Obfuscation Techniques

Wireshark - Malware traffic Analysis - 

Start collecting all the IOC ( Indicator Of Compromise). Listed below :

• IP Address

• Domain Name

• User Agent

• Host Name

• File Hashes (SHA )

• Specific Pattern

Ransomware

Ransomware is malware that encrypts a victim’s computer files, making them inaccessible, and demands a ransom be paid to restore access. This type of attack is usually carried out using a Trojan that masquerades as a legitimate file or program to trick the victim into downloading and executing it. Once executed, the ransomware encrypts files on the local computer and any connected network drives. The victim is then presented with a ransom demand, which typically requests payment in Bitcoin or another cryptocurrency.

How to Prevent Ransomware Attacks

Best practices that can help prevent ransomware attacks :

• Backup data regularly and keep backups offline. Then, in the event of an attack, backups can be used to restore encrypted files.

• Educate employees about avoiding suspicious emails and links.

• Use reputable security software, and keep it up to date.

• Restrict user permissions. Users should only have access to the data and systems they need to do their jobs.

SQL Injection

SQL injection is an attack that allows attackers to execute malicious SQL queries against a database. The attacker inserts malicious code into an input field, such as a login form; the database then executes that. This can allow the attacker to access sensitive data, such as customer records or credit card numbers. Additionally, SQL injection can modify data in the database or delete it entirely.

How to Prevent SQL Injection Attacks

Organizations can protect themselves from SQL injection attacks by using parameterized queries. This type of query defines each input field as a parameter, preventing malicious code execution. Additionally, organizations can use web application firewalls (WAFs) to detect and block SQL injection attempts.

More details click -       SQL Injection 

Malware

Malware is a type of malicious software that can be used to damage or disable computers, networks, and systems. For example, malware can steal sensitive data, such as login credentials or credit card numbers. Additionally, malware can be used to hijack computers and use them to carry out attacks, such as DDoS attacks. There are many different types of malware, including viruses, worms, Trojans, and rootkits.

How to Prevent Malware Attacks

Organizations can protect themselves from malware attacks by using security software, such as antivirus and anti-malware programs. These programs can detect and remove malware from computers and networks. Additionally, organizations should keep their operating systems and software up-to-date, as this can help prevent malware from being able to exploit vulnerabilities.

Password Attacks ( Brute Force Attack )

A password attack is a type of attack that attempts to guess or brute force a password. Password guessing can be done using common passwords, such as "password" or "123456". Additionally, attackers can use brute force methods to try every possible combination of characters until the correct password is guessed. Password attacks can also be carried out using phishing emails or malware.

How to Prevent Password Attacks

Organizations can protect themselves from password attacks by implementing strong password policies. These policies should require employees to use complex passwords that are not easily guessed. Additionally, organizations can use two-factor authentication (2FA), which requires a second form of verification, such as a one-time code and a password.

Insider Threats

An insider threat is a type of attack that comes from within an organization. Insider threats can be carried out by malicious insiders, such as disgruntled employees, or by careless insiders, such as employees who accidentally leak data. Insider threats can be difficult to detect and prevent because the attackers already have access to the organization's systems and data.

How to Prevent Insider Threats Attacks

Organizations can protect themselves from insider threats by using security software, such as activity monitoring and data loss prevention (DLP) programs. These programs can help organizations detect and prevent malicious or accidental data leaks. Additionally, organizations should provide employees with security training to educate them on proper security procedures.