Archive, Volume 1: conference talks and papers on security and risk, 2010 to 2018. Zola 2011-10-19T00:00:00+00:00 https://blog.itys.net/vol1/tags/playbooks/atom.xml 2011-10-19T00:00:00+00:00 2011-10-19T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/incident-handling-mncia/ <p>The SANS Incident Handling &amp; Forensics presentation by Matthew J. Harmon provides a comprehensive overview of how organizations should prepare for, respond to, and learn from security incidents. Drawing on industry best practices and real-world examples, it emphasizes the importance of structured processes, clear communication, and rigorous evidence handling to minimize damage and restore operations promptly.</p> <h2 id="incident-response">Incident Response</h2> <p>First, the talk lays out the six core phases of incident response: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learneddetailing the goals and key actions at each stage. Core principles such as work in pairs, maintain a strict chain of custody, never operate on original data, and enforce a need-to-know policy are reinforced throughout. These guidelines ensure that responders act methodically, take comprehensive notes, and prevent further compromise while preserving forensic integrity.</p> <h2 id="techniques-and-toolkits">Techniques and Toolkits</h2> <p>Second, the presentation transitions to practical techniques and toolkits. It introduces the SANS Investigative Forensic Toolkit (SIFT) and offensive-focused distributions like BackTrack for evidence acquisition and analysis. Step-by-step procedures cover documenting the scene, identifying and preserving data sources (from servers and workstations to mobile devices), performing bit-by-bit imaging, and analyzing logs and memory. Finally, it underscores the need to produce clear, audience-appropriate reportswhether for corporate management, legal teams, or law enforcementto drive improvements and policy changes post-incident.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/55853_2011-10-19_Incident_Handling_Forensics_and_Hacking_Techniques-MNCIA.pdf">Minnesota High Tech Crime Investigators Association</a></p>