-: Eradication and recovery.
When you go to conduct eradication and recovery
of the malware from your network
there's a couple of different things you want to focus on.
The first one is you want to remove any artifacts
of the incident.
That means you want to find the malware
and any changes that it make
and change that all back to normal.
This can be done by refreshing your system,
by going back and restoring from a good know backup
or by rebuilding the system.
You also want to restore the network back to
full functionality,
because sometimes during our eradication and recovery
or during our containment phase
we have cut off pieces of the network or segmented it.
We want to be able to get all that back
into normal operations.
Then we want to correct any security deficiencies.
So if the bad guys found a way in,
because you left a port open or you had a vulnerable service
you want to make sure that all gets fixed
and then the last thing is you want to remove
malicious code, sanitize any compromised media,
and fix any affected user accounts.
So if you were the victim of a spear fishing attack
that user account is now considered compromised
and must be rebuilt.
So what is recovery not?
Well there is several things recovery is not.
The first thing is it is not rebuilding your entire network,
it is not an excuse to redesign the whole network
and it's not a reason to go out and buy all new equipment.
Now may you need to buy some new equipment
as part of recovery, maybe,
but it's not the excuse to your bosses to say well
now I need a 1.3 million dollar upgrade to my network,
because we've been compromised.
Instead address the specific issues,
get back to full operations as quickly as possible,
and then submit those things in a formal budget request
going through the normal processes.
So when we reconstruct and reimage our systems
there's a couple of ways we can do this.
The first thing to remember is that
anytime a malicious actor or a bad guy touches your system
it's consider compromised.
Even if you scan it and you don't find something,
but you knew that he had accessed it
there might be something hiding there.
You want to recover from known good backups
or reimage it from scratch and build that system again.
This is going to allow you to make sure you have a
good system that you know is secure
and once you've done that you want to consider
what the root cause of the incident was,
because that may not be the only system that was affected.
For example, if somebody has
exploited a vulnerability in Windows 2008
on your SQL server
and you realize you're still running
a Windows 2008 Exchange server
and a Windows 2008 domain controller
and all those other things
those are ones that could also be affected.
So you want to make sure you fix the security bugs
in those as well not just the one that was affected.
So it's a little bit broader than that.
Now this makes sure you're not going to get hit
by the same attack vector over and over and over again.
Patching, patching you're systems is probably
the most important thing you can do to secure them.
Patch any systems that were vulnerable
to the same attack vector just like we talked about.
If you have other Windows 2008 servers
or other Windows 2012 servers that are vulnerable
make sure those are patched.
Ensure that they're being scanned with your
vulnerability management program
and then patch those that are vulnerable.
This is a good time to scan the whole network
and patch all of your systems.
This is where you want to make sure you're ready to go,
because here is the dirty little truth.
When you kick the bad guy off your network
he's going to try to come back.
He is gonna try to get back in.
So you've got to make sure you plug all those holes.
Sanitization and disposal.
So when you start talking about sanitization and disposal
it's how are you going to clear
the information off of those drives.
Well there's three ways you can do it.
You can clear the information,
you can purge the information,
or you can destroy the information.
Now what do each of those mean?
Well when you clear it you're using logical techniques
like deleting the file and emptying the recycle bin.
That's a way to clear the information.
You might overwrite that area of the disk
by doing a secure erase and
covering that area of the disk with zeros one time.
That's a logical technique, it's called clearing.
Now purging takes it a step further.
It can use logical techniques
like overwriting the drive with zeros
like 35 times so it's unrecoverable
or you can do physical damage to the drive.
You can put it through a degaussing machine
where all of the sectors just get completely blown away
and recovering from that disk is infeasible
even using the newest technologies and techniques.
The third way is destroy
and when you destroy it you are
physically pulverizing this drive.
You are lighting it on fire,
you're putting it through a shredder,
if it's like a CD or a floppy you can shred it.
If it's a hard drive you could drill holes through it,
whatever you want to do to just destroy this data source
so that data recovery is infeasible using
any kind of techniques, because we just want to make sure
it is completely destroyed.
Now why would you use destroying?
Well you would do it if it's a really high secure system.
Let's look at this next chart here.
We have a flow chart on the screen
and you can see that there is the security categorization
of low, moderate, and high.
Low might just be some regular old
data you have sitting on your system.
If it was compromised or you want to clear it
you would just use a clearer or purge, something low level.
You can clear it by deleting it and erasing it
or you can purge it by overwriting it with zeros,
that would be ... several times.
That could be perfectly fine.
You validate that, you document it, and then you're done,
but if you start digging into moderate level
you've got to go into a purge technique
and if you go down to a high and you have something like
personal identifiable information,
you have top secret information
because you're working for the government,
you have some kind of classified information
for your business organization
and you don't want that to fall in the wrong hands.
You need to start going into the destroy category
where you are incinerating the drive,
you're pulverizing the drive,
you're just destroying it beyond recognition,
that's what you want to do
to keep that high security information secure.
Finally, you're going to have a validation effort.
So now that we've fixed the computer
or the system or the network
we've patched it, we've scanned it for vulnerabilities,
we've patched all those,
we've taken the old hard drives, we've destroyed them all
or purged them or cleared them,
now we're going to validate it.
This is when we go through a
couple of things to make sure things are done right.
The first is we want to check our user accounts.
Are only authorized user accounts
existing on each system in the network.
If so we're in a good place.
If we start seeing accounts we're not sure of
that could have been the bad guy leaving additional ways
for him to get back in.
You want to verify your permissions
that are assigned to each user.
Make sure that when the bad guy got in your network
he didn't assign himself administrative rights
on John Smith's account and still had access to it.
You want to verify that all the
systems are logging correctly
because one of the things bad guys like to do
is turn off logging features to cover their tracks.
Make sure all of that is back on
so you can detect the next bad guy.
Then you want to verify your vulnerability scans
against all systems and make sure that they're
routinely being conducted,
whether that's weekly or monthly
based on your organizational policies.
Sometimes people will mess with your vulnerability scanners
or you may not have caught the issue in the first place,
because you haven't been conducting
your vulnerability scans.
Either way you want to make sure you're scanning,
because again scan, patch, scan is the
top way of securing your systems.
Scan the network, patch what's missing,
and scan again to verify you did it correctly
and that's what we're talking about here.
(electric music)