The Road to CEIC 2012 – Day Four of CEIC v12: Thanks for a Great Conference!

Jessica Bair

The “Road to CEIC 2012” is a series of blog posts on all things CEIC (@CEIC_Conf), before, during and after, from an insider’s point of view.

The final day of CEIC v12 started a little later, allowing attendees to pack, check-out and have a little more coffee before the 20+ sessions began at 8:30am. In the Cyber Response Lab, the room overflowed with the stand-by attendees anxious to learn more about the hot topic of Collection and Analysis of RAM (Physical Memory) by Mike Webber, owner of BitSec Global Forensics. Mike shared the importance of properly seizing and analyzing the contents of physical memory (RAM) using open source and commercially available tools, such as EnCase EnCase Forensic WinEn, EnCase Portable, EnCase Enterprise and EnCase Cybersecurity. Mike then took the attendees through several practical exercises reflecting real-life scenarios and the opportunity to practice with the tools in the lab. We then moved to analysis of the volatile data, including correlating with the static forensic evidence.

After a short break, we wrapped up the Cyber Response Lab track with an encore presentation of the popular lab Memory Analysis & Malware Triage by David Nardoni, director at PWC, and Jef Dye, manager at PWC. David and Jeff did a great job in taking the eager attendees through an overview of commercial and free tools for live memory collection and analysis. Then they covered core malware triage techniques, with tips & tricks and how to avoid common pitfalls.

Our thanks to the excellent presenters who made the Cyber Response Labs track such a popular venue and successful experience for the attendees. We extend that appreciation to all those who made the other ten tracks successful, and together made CEIC v12 such a comprehensive event; premier in the depth and breadth of digital investigations. It was gratifying and humbling to have so many folks stop me throughout these past four days; to share how impressed they were with CEIC v12, and appreciative of the work and resources invested to make it the best conference possible.

As I was walking back to the Training Department “war room” from the last Cyber Response Lab, I was stopped by our new sales account executive for Latin America, who asked if I could do a “quick demo” of EnCase Cybersecurity before our TechBiz business partner and two groups of customers from Brazil. I knew I would miss my airport shuttle and made fast bargain: a demonstration and discussion for a ride to the airport afterwards. He readily agreed, and we set up in a boardroom for the impromptu meeting. For the EnCase Cybersecurity course, we have a full network setup in Pasadena for the classroom instruction, including workstations, Exchange server, file server, and targets; and I had it prepared for a course in the United Kingdom next month. I was able to connect with terminal services over wireless to the network; and an hour later the questions and scenarios they had were exhausted and broad smiles remained. The customers, the partner and the account executive were amazed at the power, versatility and flexibility of EnCase Cybersecurity. It was a fun reminder of why I enjoy my career every day: the opportunity work with great people and to share this incredible technology with digital investigators; who use it to make our world a little safer.

It was a capstone experience for a wonderful week…and I still made my flight on time. As @EPYX_Pete tweeted, “#CEIC2012 is a wrap! Thanks to all for a great conference once again. Made some great new contacts. See u in Orlando #CEIC2013 ”.

Well said!

Jessica Bair
Senior Director, Curriculum Development
@jessicambair

The Road to CEIC 2012 – Day Three of CEIC v12: A Full Day of Learning

Jessica Bair

The “Road to CEIC 2012” is a series of blog posts on all things CEIC (@CEIC_Conf), before, during and after, from an insider’s point of view.

The Road to CEIC 2012 – Day Two of CEIC v12: Serious Brain Power!

Jessica Bair

The “Road to CEIC 2012” is a series of blog posts on all things CEIC (@CEIC_Conf), before, during and after, from an insider’s point of view.

With breakfast at 7am on Tuesday, 22 May, the first full day of CEIC v12 started off with networking and reunions. I was pleasantly surprised to see another US Army CID buddy who received last minute authorization to attend and had arrived at 1am…he appreciated the coffee!

By 7:50am, the Cyber Response lab room was already full; a trend that is prevalent throughout the conference. As @CernamOwen noted, “People at #ceic2012 are amazingly punctual - 15 minutes to go and the room is filling up.” The first lab was EnCase Cybersecurity: Automating Incident Response, presented by the Guidance Software, Inc. developers who actually created the software: Ambreesh Bhagtani, manager of enterprise application development, and Jason Fredrickson, senior director of enterprise application development. Ambreesh and Jason demonstrated how to use the APIs in EnCase Cybersecurity for automated incident response, by integrating with a Security Information and Event Management (SIEM) tool as a triggering system. You can see a video demonstration of the integration here.

The Industry Keynote followed at 9:30am, with General Richard Myers, Retired, 15th Chairman of the Joint Chiefs of Staff. In 2005, General Myers wrote the rules on governing cyber attacks, which applied to internal DOD networks and governed what actions could be taken if those networks were breached. In his address, General Myers discussed three topics on future security: 1) What threats will endure, 2) How will the United States Respond, and 3) How will International organizations assist? @CEIC_Conf carried live tweeting of General Myers remarks; and one of the primary enduring threats he covered was Cybersecurity and network intrusions. Before taking questions, General Myers thanked the CEIC attendees for their work in securing our future from these threats.

The Exhibit Hall opened for the first time after the Keynote, where we grabbed a refreshment and checked out several booths of the 53 sponsors, before heading back to the sessions. The Search for a Holy Grail: Attribution continued the Cyber Response track, presented by Tim Dillman, director at KPMG. Tim took the attendees through the three ‘levels’ of identification (IP address, device, and user); and freely shared the tools and techniques he uses for attribution (i.e., user identification) for prosecution.

A fun factoid about CEIC: over 4,300 lunches will be served this week. The conference hall filled for lunch, so we overflowed to the pool for sun and more connecting. Dessert was back in the Exhibit Hall, where we had the opportunity for a hands-on demo of the new Tableau TD3 Forensic Imager and learn about the EnCase v7 Transition training and certifications. Some other fun facts: with 11 tracks to choose from, there are over 80 presenters sharing over 110 labs and presentations this week, with 496 lab computers and nearly 13,000 session seats available. Fortunately there is standing room, as every lab I’ve visited to date has been filled past the available seating, by the stand-by attendees grateful to get in the rooms.

After lunch, Paul Nichols and Brian Hussey, of Harris Corporation conducted the Cyber Response lab Dynamic Malware Analysis of Emerging Threats. This was an intense hands-on lab, with two VMware machines for sandbox dynamic analysis of a live kernel level rootkit. Paul and Brian kept the attendees on track with excellent instruction skills and step-by-step documentation.

The final Network Forensic Investigations of Hacking Incidents lab of the day was Network Forensic Investigations of Hacking Incidents, with Ondrej Krehel, CISO of ID Theft 911, LLC. Ondrej led a hands-on lab with open source network forensic analysis tools, demonstrating how captured traffic can be analyzed and reconstructed. Advanced hacker tools can compromise systems, without leaving traces on hard disks; thus requiring volatile data and/or network forensic analysis. This lab exposed me to new techniques and ideas, well done!

Happy Hour at the Exhibit Hall wrapped up Day Two from 5:30 – 6:30pm. Meanwhile, over a dozen dedicated candidates took the opportunity to sit for the EnCE and EnCEP tests, free at the conference; while the rest of use enjoyed the hospitality. The EnCase App Central (#EnCaseAppCentral) was officially announced to the rest of the world today, with over 30 programmers having now joined the Developer Network, thanks to the work of Simon Key (‏@SimonDCKey) and James Habben. They were observed speaking about a new EnScript idea with Shawn McCreight, Jason Fredrickson and Dominik Weber, serious Brain Power at CEICv12!

Jessica Bair
Senior Director, Curriculum Development
@jessicambair

The Road to CEIC 2012 – Day One of CEIC v12: A Perfect Start

Jessica Bair

The “Road to CEIC 2012” is a series of blog posts on all things CEIC (@CEIC_Conf), before, during and after, from an insider’s point of view.

All of the work to prepare for CEIC v12 paid off, as the staff made the final touches in the morning of Monday, 21 May, before Registration opened at 9am. The early birds, of the nearly 2,000 expected to attend CEIC v12, lined up to start their conference experience with enthusiasm. New to CEIC is the Guidance Software CISO Summit – Beyond the Enterprise Perimeter: The Power of Data Visibility & Incident Response, an exclusive event for information security executives and industry thought leaders. The Summit began even before Registration opened, and these dedicated men and women met until 2:30pm to exchange ideas and learn about the importance of digital investigative technology in protecting their organization from risk and threats.

The Summit opened with the Keynote: Data Breaches by the Numbers by Dr. Larry Ponemon (founder, Ponemon Institute) and Bryan Sartin (director of investigative response, Verizon Business) and continued with Matt Keller (Worldwide Information Network Systems) discussing The Last Line of Defense against the APT: Integrating Forensic Response into the Security Stack. The Summit broadened into E-discovery before the lunch break with the Honorable Andrew J. Peck (US Magistrate Judge) and Lee Warren (CISO, United Technologies Corporation) leading an interactive Q&A on Why E-Discovery is Important to Your Company and Why it Should Be to You.

After lunch, the Summit moved into actionable solutions with Getting Ahead of the Inevitable: Implementing an Incident Management Framework, by Mark Carney (vice president of strategic services, FishNet Security). Followed by Shawn McCreight (chief technology officer and founder, Guidance Software), with the capstone The Impact of Forensics on Data Visibility and Enterprise Risk Management.

The Opening Keynote kicked off shortly after 3pm, with Alex Andrianopoulos, vice president of marketing, warming up the standing-room-only crowd for Victor Limongelli, president and chief executive officer, delivering a humorous review of the growth of CEIC. The event was covered live on Twitter, as Victor traced the history of digital forensics over the last 15 years, from an obscure, esoteric endeavor practiced only by small cadre of experts to a conventional discipline employed by tens of thousands. Victor addressed how the continuing proliferation of computing devices, the ever-increasing volumes of data, and the need for visibility into that data, is all driving a forensics explosion. There is a democratization of forensics, with modern solutions requiring ease of use and collaboration between experts. Victor was joined by Ken Basore, senior vice president of R&D and IT, for a live demonstration of EnCase Portable v3 and the EnCase v7 Review Package feature. Jim Borecki, vice president of forensic business unit, also made an appearance to iintroduce the new Tableau TD3 Forensic Duplicator.

The first sessions started at 4:30pm, with 11 from which to choose, a seemly impossible task. The Cyber Response lab track was filled to seating capacity early, and those arriving “on time” were allowed to stand in the back; as Tim Dillman of FishNet Security took us down the Yellow Brick Evidence Trail to catch attackers. The lab was hands-on with EnCase Enterprise, evolving into an interactive session of sharing tips and tricks between Tim and the attendees.

The E-Discovery Done Right and EnCase App Central Rotundas were very popular throughout the day. The EE-Discovery exhibit drew crowds excited to learn about the integration of EnCase eDiscovery and CaseCentral. Several programmers signed up to join the App Central developer community, where they receive a personal copy of EnCase Forensic to aid in their EnScript creation, with the App Central market place launch planned later in 2012.

The Welcome Reception filled the pool area from 6pm until dark, with attendees enjoying entertainment from Cirque du Soleil and connecting with each other. I enjoyed interacting with friends from my computer forensic examiner days in the US Army CID, with former co-workers who are now partners, with new partners, with colleagues from across the globe, and meeting customers from around the world. Incredibly, over 40 countries are represented as we begin CEIC v12….a perfect start!

Jessica Bair
Senior Director, Curriculum Development
@jessicambair

The Road to CEIC 2012 – A Beautiful Day at the CEIC v12 Rotundas

Jessica Bair

The “Road to CEIC 2012” is a series of blog posts on all things CEIC (@CEIC_Conf), before, during and after, from an insider’s point of view.

In the center of the bustling activity on Monday, attendees found a new addition to CEIC, the Rotundas in the Red Rock Veranda room, with two interactive exhibits: E-Discovery Done Right and EnCase App Central.

The E-Discovery Done Right Rotunda is the official CEIC lounge for all things e-discovery. It is the place attendees can visit throughout CEIC v12 to speak with experts about how to streamline your e-discovery processes. Join others who took the opportunity to meet Case Central, the newest addition to the Guidance Software family. With the acquisition of CaseCentral, Guidance Software delivers a complete e-discovery solution, addressing the needs of corporations and government agencies. The combined product portfolio provides increased efficiency and automation, as well as lower risk for e-discovery activities. The integrated solution spans from legal hold, identification, collection, preservation, processing, first pass review and early case assessment through review and production capabilities.

The combined offering deploys software intelligently, with EnCase eDiscovery delivering the legal hold, identification, collection, preservation, processing, ECA, and first pass review functions on-premise, at your site — close to the sources of data and the data custodians — and CaseCentral delivering additional capabilities for early case assessment, review and production functions as SaaS in the Cloud, so that geographically dispersed inside and outside counsel can efficiently review and produce without needing any special equipment or software other than a web browser and internet connectivity. The scheduled presentations continue through Wednesday, May 23, on E-Discovery Done Right, Early Case Assessment and Legal Hold; along with a Happy Hour each evening. See schedule below.

At the EnCase App Central Rotunda, attendees are learning about the new online exchange for EnScripts®. Several years ago, we created the ability to protect the source code of your EnScripts through EnPack licensing. This made it possible for third-parties to develop and sell EnScripts for EnCase Forensic and the EnCase Enterprise platform on their websites. There is also an EnScript Resource Center on the Guidance Software Support Portal (registration required) with over 230 free EnScripts posted by Guidance Software staff and the EnCase user community. With the EnCase App Central marketplace, there will be a place for you to go to find EnScripts for all of your digital investigation needs; and if you are a developer, to market your intellectual property and be compensated for your work.

The EnCase App Central Rotunda is staffed by veteran instructors James Habben and Simon Key. These are the brilliant gentlemen who develop and teach the popular expert courses EnScript® Programming and EnCase Macintosh® / Linux Examinations, respectively. You can also catch James and Simon teaching labs ranging from EnScript for Non-programmers, to File Block Hash Map Analysis, to Kindle Fire Investigations and Decoding Prefetch Files.

In 2005, I led the team that created EnCase eDiscovery v1, and visited CaseCentral for the initial conversations on our partnership. It is gratifying to see that partnership blossom into a family relationship…and create such a comprehensive solution! Prior, I was in Research and Development, where we envisioned the day where developers and customers could connect on the web to buy and sell EnScripts. It is a beautiful day indeed…come check out the Rotundas for yourself.

Jessica Bair
Senior Director, Curriculum Development
@jessicambair

Rotunda and Expo Hall Presentations:

E-Discovery Done Right, Legal Holds, EnCase App Central Overview, E-Discovery Review & Production, Forensic Solutions, Partner Showcases, EnCase Cybersecurity and more.

EnCase App Central and E-Discovery Done Right Rotunda Hours:

Monday: 9:00a to 6:00p
Tuesday: 7:00a to 5:30p
Wednesday: 7:00a to 6:00p
Thursday: 7:30a to Noon

Expo Hall Hours

Tuesday: 10:30a to 6:30p
Wednesday: 9:30a to 3:30p

Presentation Schedule (10 Min. Presentations)

EnCase App Central Rotunda

MONDAY
11:30a - App Central Overview
2:00p - App Central Overview

TUESDAY
10:40a - App Central Overview
1:30p - Partner Showcase
3:40p - Partner Showcase

WEDNESDAY
12:30p - Partner Showcase
1:30p- Partner Showcase
3:15p - App Central Overview

E-Discovery Done Right Rotunda

MONDAY
11:00a - E-Discovery Done Right
1:00p - Legal Review & Production
1:30p - Legal Hold

TUESDAY

12:30p - E-Discovery Done Right
1:00p - Early Case Assessment
2:00p - Legal Hold

WEDNESDAY

9:40a - E-Discovery Done Right
1:30p - E-Discovery Done Right
3:45p - Legal Review & Production
4:15p - Legal Hold
5:10p - Early Case Assessment

The Road to CEIC 2012 – Keynotes to Kick Off CEIC v12

Jessica Bair

The “Road to CEIC 2012” is a series of blog posts on all things CEIC (@CEIC_Conf), before, during and after, from an insider’s point of view.

The Keynote addresses at CEIC have always been much anticipated and this year is no different! To start off CEIC v12, we will have the Opening Keynote on Monday, May 21st at 3:00 p.m. with Victor Limongelli, president and chief executive officer of Guidance Software. Over the last 15 years, digital forensics has moved from an obscure, esoteric endeavor practiced only by small cadre of experts to a conventional discipline used by tens of thousands. We have moved from purely “dead box” forensics to live, remote forensics, mobile phone forensics and triage tools. Victor will address how the continuing proliferation of computing devices, the ever-increasing volumes of data, and the need for visibility into that data, is all driving a forensics explosion: a democratization of forensics, such that more and more individuals – some experts, some not – will play a role in utilizing forensics to deliver answers to the challenges posed by the data explosion. He will be joined by other Guidance Software executives, including Ken Basore, senior vice president of R&D and IT and Jim Borecki, vice president of forensic business unit. Each will be sharing exciting announcements for the digital investigations community.

We are honored to have General Richard Myers, Retired, 15th Chairman of the Joint Chiefs of Staff, deliver the Industry Keynote address for CEIC v12 at 9:30 a.m. on Tuesday, May 22nd, the first full day of CEIC v12. As a primary architect of the United States Defense Policy since 9/11, General Myers sees current national security challenges tantamount to those faced during World War II. He will articulate to CEIC attendees what hangs in the balance, illustrating the deep threats and bold challenges that confront the world today.

As Chairman of the Joint Chiefs of Staff from 2001 to 2005, General Myers led the United States military through four years of tumultuous change on the international and domestic stage. In 2005, General Myers wrote the rules on governing cyber attacks, which applied to internal DOD networks and governed what actions could be taken if those networks were breached. In 2007, General Myers became one of three selected for the first CIA External Advisory Board, which is responsible for providing advice on management and related issues to the intelligence community.

Whether overseeing the War on Terror or disaster relief or the rules of cybersecurity, General Myers knows the importance of security, both physical and virtual; and he will inspire you on Tuesday with his unique insight on national and global security issues, political military affairs and leadership.

General Myers will join the illustrious ranks of prior Keynote speakers, who include Eric O'Neill, Subject of the film “Breach ” for capturing spy Robert Hanssen; Leonard Nimoy, best known for his portrayal Mr. Spock in Star Trek™; Capt. James Lovell, commander of the Apollo 13 mission; Howard Schmidt, former White House cybersecurity chief; and Frank Abagnale, subject of the movie “Catch Me if You Can”.

You will find me near the front row for both Keynotes!

Jessica Bair
Senior Director, Curriculum Development
@jessicambair

The Road to CEIC 2012 – Meet Me! at CEIC v12

Jessica Bair The “Road to CEIC 2012” is a series of blog posts on all things CEIC (@CEIC_Conf), before, during and after, from an insider’s point of view.

We just had the official CEIC briefing for all Guidance Software, Inc. staff attending this year…and goodness it is going to be a fabulous event: CEIC v12!

It will be the biggest CEIC to date, approaching 2,000 of your peers, experts and practitioners in attendance. Over 50 sponsors will be filling the exhibit hall, representing the best in computer forensic, e-discovery and cybersecurity products and services; where you will have an opportunity to put your hands on the new Tableau TD3 Forensic Duplicator and other new Tableau forensic duplicators and bridges. The Red Rock Resort will be bursting with activity, with regular shuttle service to the overflow hotels, The Element and JW Marriott.

Registration opens at 9:00 a.m. on Monday, May 21; with the Opening Keynote at 3pm, with Victor Limongelli, president and chief executive officer. Afterwards, the sessions begin and you will find me in the Cyber Response lab with Tim Dillman of Fishnet Security, who is also the co-sponsor of the Guidance Software CISO Summit, an exclusive event for information security executives and thought leaders. There are 11 labs or presentations the first evening alone…something for everyone. Then, we can all meet up at the Welcome Reception from 6:00-8:00 p.m. at the pool. Bring your business cards and Smartphones to exchange contacts. You will want to be up for breakfast and the second session at 8:00 a.m. on Tuesday; followed by the Industry Keynote by General Richard Myers, Retired, 15th Chairman of the Joint Chiefs of Staff at 9:30 a.m.

For those planning to take the EnCE® or EnCEP® phase I test, there are eight time slots available this year; held in a quiet room where you can concentrate. The certification check-in will be next to registration, and you will likely have a chance to meet Miautra Dias in person, the fabulous Certification Coordinator who manages hundreds of applications, exam results and renewals every year.

For EnCase Enterprise users looking for some one-on-one technical time with an SME, there will be a Meet the EnCase Experts room for private discussions with Daniel Smyth and Bradley Le-Roy, veteran and skilled principal consultants with Professional Services. If you are looking forward to meeting a Guidance Software staff member at CEIC, ask him or her to book a Meet Me! At CEIC room so you can have a quiet place to talk and confer. If you would like to share your enthusiasm for EnCase products and Guidance Software services, ask a staff member about recording your own video testimonial while at CEIC. There will also be a killer deal on a Forensics Investigation Package for CEIC attendees, including EnCase Forensic v7, Passware Kit Forensic, EnCase Portable, and one year EnCase SMS…look in your registration materials for details.

Also, new this year is the Rotunda area with two exhibits you won’t want to miss. First is the E-Discovery Done Right Rotunda, where you can learn about all things e-discovery, get ideas on how to streamline your e-discovery processes and meet CaseCentral, the newest member of the Guidance Software family. Second is the EnCase App Central Rotunda, where you can learn about the introduction of the online exchange for EnScripts.

Questions? Grab a Guidance Software staff member and we will be happy to assist. You will find our team wearing a Guidance Software pin or blue polo shirt to help you identify us. Staff members who are lecturing or leading a lab will be sporting a black Guidance Software polo; and you will notice dozens of employees wearing orange t-shirts to help you with session check-ins and other questions.

CEIC v12 is going to be THE premier event for the exchange of best practices in digital investigations!

Jessica Bair
Senior Director, Curriculum Development
@jessicambair

The Road to CEIC 2012 – Cyber Response Lab: Memory Analysis & Malware Triage

Jessica Bair The “Road to CEIC 2012” is a series of blog posts on all things CEIC (@CEIC_Conf), before, during and after, from an insider’s point of view.

The traditional method of collecting digital evidence was to shutdown the system, either gracefully or by pulling the plug, and then image all the media contained within the system for later static forensic analysis. With the advancement of malware today, and memory-only resident malicious code that never touches the hard drive, it is extremely important to try to capture the contents of memory for inclusion in your overall analysis methods. As I mentioned in my last posting on network forensic analysis, volatile data analysis is a crucial part of the three pillars of an incident response investigation, and the topic of the Cyber Response lab entitled Memory Analysis & Malware Triage.

Volatile data exists in the main memory (RAM) of a server or workstation; if power is lost or a system fault occurs, the data is gone. Volatile data can help you determine if suspicious applications or activities are present on a system, and help guide you in the search for backdoors or malicious code. Additionally, it may help you determine who and what is accessing the system and its resources, whether internal or externally. One of the most important aspects of volatile data capture is that it provides you with the ability to quickly ascertain if unauthorized ports, processes, or applications are active. This information is critical when deciding whether to continue system operations or take the system offline. This is a core component of incident response triage; the ability to rapidly determine to what extent, if any, a system has been compromised, ideally using network-enabled tools such as EnCase® Cybersecurity.

David Nardoni (EnCE, CISSP, GCIH) will lead this hands-on lab, where you will learn the basics of live memory collection and its importance during an investigation, especially involving malware. With David, you will explore the differences between memory collection and analysis tools, including the widely used Volatility Framework. David is a Director at PwC. He has over 14 years of experience in the information security industry and eight years in practicing computer forensics investigations. Also, he taught computer forensics at the University of Southern California (USC) and is a Reserve Police Officer with the City of Sierra Madre.

With David’s vast experience in computer based investigations, ranging from PCI data breaches, APT attacks, identity theft, malware attacks, email extortion and intellectual property theft; I know there will be many memory analysis & malware triage tips and tricks to glean from his lab!

Jessica Bair
Senior Director, Curriculum Development
@jessicambair

CEIC 2012 – Cyber Response Lab

Wednesday
1:30 PM - 3:00 PM
Memory Analysis & Malware Triage
David Nardoni, Director (PwC)
Skill Level: Intermediate

The Road to CEIC 2012 – Network Forensic Investigations of Hacking Incidents

Jessica Bair The “Road to CEIC 2012” is a series of blog posts on all things CEIC (@CEIC_Conf), before, during and after, from an insider’s point of view.

Investigating a hacking incident requires a holistic approach: analysis of volatile data, forensic static data and network forensic data. The latter discipline is the heart of the Cyber Response lab entitled Network Forensic Investigations of Hacking Incidents. Ondrej Krehel, CISO for Identity Theft 911, and Jaro Krett, senior IT security analyst of Loews Corp, will be teaching you network forensic skills, techniques for finding compromised hosts, and capturing & reconstructing malicious sessions.

Why is network forensics important to you? Anti-forensics attacker techniques are increasingly encountered in incident response investigations. However, few of the very busy IT, INFOSEC and legal departments have the skills to acquire and exploit network forensics intelligence. If you are prepared and able to capture network incident data sets for further analysis, it can be a great help to your forensic investigators. Advanced hacker tools can compromise systems, without leaving traces on hard disks; thus requiring volatile data and/or network forensic analysis. In many cases, the network forensic evidence itself has stood as primary evidence. With network forensic tools, any transmitted files can be analyzed, reconstructed and replayed, even if they don’t exist on the compromised system.

Ondrej and Jaro will be utilizing the open source Network Forensic Analysis Tools (NFAT) to help you build a network forensic toolkit, analyze and investigate recorded packets, and even create your own network forensics appliance. You will see how captured traffic is analyzed and reconstructed, and various artifacts found in the investigation will be discussed. As an advanced topic, having knowledge of incident response, network protocols such as TCP/IP, UDP, HTTP, HTTPS, and OSI model will make this lab more beneficial to you.

If network forensics is an area you want to develop additional expertise, this will be an excellent hands-on lab for you to attend. I will be there, taking notes!

Jessica Bair
Senior Director, Curriculum Development
@jessicambair

CEIC 2012 – Cyber Response Lab

Tuesday
4:00 PM - 5:30 PM
Network Forensic Investigations of Hacking Incidents
Ondrej Krehel, IDT911, LLC, Jaro Krett, Loews Corp
Skill Level: Advanced

The Road to CEIC 2012 – Automating Incident Response

Jessica Bair The “Road to CEIC 2012” is a series of blog posts on all things CEIC (@CEIC_Conf), before, during and after, from an insider’s point of view.

FBI Director Robert Mueller recently stated, "There are only two types of companies: those that have been hacked, and those that will be. Even that is merging into one category: those that have been hacked and will be again." The fact is, your network security will be breached…it is a reality of the world in which we operate and do business. Each week brings new threats, and reports of compromised networks and lost data. No organization is immune.

On 24 April 2012, Darrell Arms of Accuvant and I presented a Webinar entitled Incident Response: Six Best Practices for Managing Cyber Breaches. We shared best practices for putting an incident response plan in place and how to preserve volatile data as evidence, as near time to the incident as possible. Your ability to quickly identify the breach, stop the exfiltration of data and classified material, and remediate the threat can impact your organization’s risk, cost, and exposure.

Implementing the technology for such a response plan is the focus of the Cyber Response lab entitled EnCase Cybersecurity: Automating Incident Response. This lab demonstrates how to employ automated incident response, using a Security Information and Event Management (SIEM) tool as a triggering system. This is a special engagement, as you will see how EnCase® Cybersecurity can automate response to a number of threats from the Guidance Software, Inc. developers who actually create the software: Ambreesh Bhagtani, manager of enterprise application development, and Jason Fredrickson, senior director of enterprise application development.

Ambreesh and Jason will also discuss the relevance of forensics when it comes to incident response, as it has become critical to prioritize, respond to and contain the volume of threats to your organization. They will also show you how the EnCase Cybersecurity reporting features can provide data visibility across your network, with the ability to remediate the threat from the reporting interface.

As the developer of the hands-on EnCase Cybersecurity course, I am particularly looking forward to spending this time with these gentlemen…as I know some of their tips and tricks will be incorporated into the curriculum!

Jessica Bair
Senior Director, Curriculum Development
@jessicambair

CEIC 2012 – Cyber Response Lab

Tuesday
8:00 AM - 9:15 AM
EnCase Cybersecurity: Automating Incident Response
Ambreesh Bhagtani, Guidance Software, Inc Jason Fredrickson, Guidance Software, Inc
Skill Level: All

The Road to CEIC 2012 – The Search for the Holy Grail

Jessica Bair The “Road to CEIC 2012” is a series of blog posts on all things CEIC (@CEIC_Conf), before, during and after, from an insider’s point of view.

Who breached your network?!?! Identifying the human behind the attack on your network is the ultimate goal for investigators, and the crux of Tim Mather’s Cyber Response lab entitled The Search for the Holy Grail: Attribution.

I had a sneak peek at Tim’s presentation. Wow, he brings incredible experience and expertise to this lab! Tim is an Advisory Director at KPMG, focusing on information protection and cloud computing security. Prior to joining KPMG, Tim completed a Master’s Degree in Information Assurance from Brandeis University, and is also co-author of the book "Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance”. Previously, Tim was Chief Security Strategist for RSA and Vice-President of Technology Strategy in Symantec’s Office of the Chief Technology Officer. Before that, he served for nearly seven years as Chief Information Security Officer at Symantec.

Tim knows that investigators need to move beyond Internet Protocol (IP) address identification of an attacker. He is going to show you how getting to the device ‘behind’ an IP address, even remotely, is now possible. Tim will explore with you the three ‘levels’ of identification (IP address, device, and user) and share the tools and techniques he uses. His lab will conclude with a discussion about how IP address and device identification might be used to achieve the Holy Grail – attribution (i.e., user identification) for prosecution.

While forensics is usually concerned with ex post facto attribution of tying a specific device to a specific perpetrator, it is even (far) harder to determine a specific perpetrator from a specific system during an attack. This is why Tim became an information security practitioner and why he approaches the problem of attribution differently than a forensics expert.

Attribution is a very difficult problem, and I am definitely looking forward to Tim’s lab!

Jessica Bair
Senior Director, Curriculum Development
@jessicambair

CEIC 2012 – Cyber Response Lab

Tuesday
11:00 AM - 12:30 PM
The Search for the Holy Grail: Attribution
Tim Mather, KPMG
Skill Level: Intermediate

The Road to CEIC 2012 – Cybersecurity and E-Discovery Databases Exposed!

Jessica Bair The “Road to CEIC 2012” is a series of blog posts on all things CEIC, before, during and after, from an insider’s point of view.

The Cyber Response lab is really coming together. Guidance Software Training Manager, Jamey Tubbs, and Senior Manager of Special Projects, Joe Murin, have been working diligently to ensure the base build for the Cyber Response and E-Discovery lab machines have all of the software and tools needed by the instructors. They have created an amazing infrastructure you will see when you sit down at the machines…simply brilliant!

Joe and Aaron Bennett, Guidance Software field engineer, are currently configuring the SQL databases for the E-Discovery and Cyber Response labs. Aaron will be leading the lab EnCase Cybersecurity Command Center (ECC): SQL Databases Exposed! with Stephen Pascual, manager of Enterprise Application development. Aaron and Stephen will be going through the setup and diagnosis of Microsoft SQL in the ECC Ecosystem. Those who use ECC, whether for cybersecurity or e-discovery, know that the Global and Case SQL databases are a critical part of the solution. In addition to providing a practical setup guide, they will also be covering tips and tricks for solving common problems with your SQL databases. If you are an EnCase Cybersecurity or an EnCase eDiscovery user, this lab needs to be on your schedule!

I just booked by my flight to the Las Vegas Airport. Thank goodness for WiFi enabled aircraft so I can stay connected on the way to CEIC (@CEIC_Conf)!

Jessica Bair
Senior Director, Curriculum Development
@jessicambair

CEIC 2012 – Cyber Response Lab

Wednesday
10:30 AM - 12:00 PM
EnCase Cybersecurity Command Center: SQL Databases Exposed!
Aaron Bennett, Guidance Software, Inc, Stephen Pascual, Guidance Software, Inc
Skill Level: Advanced

The Road to CEIC 2012 – Cyber Response Labs

Jessica Bair The “Road to CEIC 2012” is a series of blog posts on all things CEIC, before, during and after, from an insider’s point of view.

Welcome to the first post in our “Road to CEIC 2012” blog series, which is focused on our new Cyber Response lab track. As an eleven-year veteran of Guidance Software, Inc. and the developer of the EnCase Cybersecurity program, I have the honor of working with the Cyber Response Lab instructors to prepare for the hand-on labs.

The Cyber Response lab track at CEIC will cover everything from response methodology, to memory analysis, to attack attribution techniques and everything in between. Our instructors include seasoned incident response experts from Guidance Software, as well as visionary security practitioners such as Jaro Krett from Loews Corporation. This is the track for attendees looking to gain hands-on experience and tips to address the “now what?” that accompanies the inevitable breach.

This week marks an important milestone in our preparations. I just sent out the configuration information to the Cyber Response instructors, for the base builds of the student and instructor lab machines that Jamey Tubbs (@jameytubbs, Manager, GSI Training Houston) will be creating. We also set up an FTP site for the instructors to begin uploading their tools and materials to make each of their labs engaging and relevant.

Below is the Cyber Response labs schedule, and links to the labs’ descriptions and instructors’ biographies.

Jessica Bair
Senior Director, Curriculum Development
@jessicambair

CEIC 2012 – Cyber Response Labs

Monday
4:30 PM - 6:00 PM
Follow the Yellow Brick Evidence Trail
Tim Dillman, FishNet Security
Skill Level: All

Tuesday
8:00 AM - 9:15 AM
EnCase Cybersecurity: Automating Incident Response
Ambreesh Bhagtani, Guidance Software, Inc, Jason Fredrickson, Guidance Software, Inc
Skill Level: All

11:00 AM - 12:30 PM
The Search for the Holy Grail: Attribution
Tim Mather, KPMG
Skill Level: Intermediate

2:00 PM - 3:30 PM
Dynamic Malware Analysis of Emerging Threats
Paul Nichols, Harris Corporation, Brian Hussey, Harris Corporation
Skill Level: Intermediate

4:00 PM - 5:30 PM
Network Forensic Investigations of Hacking Incidents
Ondrej Krehel, IDT911, LLC, Jaro Krett, Loews Corp
Skill Level: Advanced

Wednesday
10:30 AM - 12:00 PM
EnCase Cybersecurity Command Center: SQL Databases Exposed!
Aaron Bennett, Guidance Software, Inc, Stephen Pascual, Guidance Software, Inc
Skill Level: Advanced

1:30 PM - 3:00 PM
Memory Analysis & Malware Triage
David Nardoni, General Dynamics Advanced Information Systems (PWC)
Skill Level: Intermediate

Thursday
8:30 AM - 10:00 AM
Collection and Analysis of RAM
Michael Webber, BitSec Global Forensics
Skill Level: Intermediate