Archive, Volume 1: conference talks and papers on security and risk, 2010 to 2018. Zola 2013-10-18T00:00:00+00:00 https://blog.itys.net/vol1/tags/incident-response/atom.xml 2013-10-18T00:00:00+00:00 2013-10-18T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/ddos-survival-isc2tc/ <h2 id="summary">Summary</h2> <p>Matthew J. Harmon and Phil Reno present at the (ISC)2 Twin Cities Area Chapter on DDoS Survival, delivered on October 18, 2013, provides a comprehensive primer on Distributed Denial of Service (DDoS) attacks and how organizations can withstand and mitigate them. It begins by defining DDoS as resource exhaustion aimed at disrupting servicesand tracing its roots from IRC-driven pranks to sophisticated protest and extortion campaigns.</p> <h2 id="threats-and-attack-techniques">Threats and Attack Techniques</h2> <p>The first section surveys real-world threats and attack techniques. The presenters highlight notable incidents such as Anonymous/AntiSec campaigns and itsoknoproblembro browser-based botnets and reference data on rising attack volumes from sources like Arbor Networks. They categorize attack vectors across the OSI stack (TCP/SSL floods, HTTP-level assaults like Slowloris and chunked-header exploits, and ICMP/UDP floods) and assess attacker skill levels, from low-effort LOIC/XOIC scripts to more advanced injection-driven browser botnets.</p> <h2 id="defense-and-resilience">Defense and Resilience</h2> <p>The second section focuses on defense and resilience strategies. Harmon and Reno outline four architectural approaches: ISP-level scrubbing, Cloud SOC via proxy/DNS redirection, full-service cloud scrubbing with BGP rerouting, and in-house solutions. Detailing the pros and cons of each. They emphasize risk transference through CDNs and anti-DDoS services, null-routing tactics, and bigger pipes, supplemented by application-level tweaks. The presentation concludes with guidance on selecting providers (key questions on SLAs, mitigation capabilities, and cost structures), proactive load testing, and leveraging automation tools (Chef, Puppet, Ansible, SaltStack, Fabric) to scale and verify infrastructure readiness under attack.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/56583_2013-10-18_DDoS_Survival-ISC2TC.pdf">DDoS Survival</a></p> 2011-10-19T00:00:00+00:00 2011-10-19T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/incident-handling-mncia/ <p>The SANS Incident Handling &amp; Forensics presentation by Matthew J. Harmon provides a comprehensive overview of how organizations should prepare for, respond to, and learn from security incidents. Drawing on industry best practices and real-world examples, it emphasizes the importance of structured processes, clear communication, and rigorous evidence handling to minimize damage and restore operations promptly.</p> <h2 id="incident-response">Incident Response</h2> <p>First, the talk lays out the six core phases of incident response: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learneddetailing the goals and key actions at each stage. Core principles such as work in pairs, maintain a strict chain of custody, never operate on original data, and enforce a need-to-know policy are reinforced throughout. These guidelines ensure that responders act methodically, take comprehensive notes, and prevent further compromise while preserving forensic integrity.</p> <h2 id="techniques-and-toolkits">Techniques and Toolkits</h2> <p>Second, the presentation transitions to practical techniques and toolkits. It introduces the SANS Investigative Forensic Toolkit (SIFT) and offensive-focused distributions like BackTrack for evidence acquisition and analysis. Step-by-step procedures cover documenting the scene, identifying and preserving data sources (from servers and workstations to mobile devices), performing bit-by-bit imaging, and analyzing logs and memory. Finally, it underscores the need to produce clear, audience-appropriate reportswhether for corporate management, legal teams, or law enforcementto drive improvements and policy changes post-incident.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/55853_2011-10-19_Incident_Handling_Forensics_and_Hacking_Techniques-MNCIA.pdf">Minnesota High Tech Crime Investigators Association</a></p>