When we investigate a system compromise we are often left with only one portion of the cause->effect equation. It's up to us to take what we are presented with, and reconstruct a crime scene in order to determine what happened and often times determine whether or not PII data was acquired.
Using your imagination, try picturing the following scenario:
You arrive at a crime scene at a jewelry store and are lead to a body laying on the floor in a pool of blood. There is a broken lamp on a table, a large dent in the painted wall at about the 5'6" mark near the victim, a hole farther down on the wall at about the two foot height mark. There's blood spatter on the wall, floor and ceiling. Bloody footprints surround the victim and lead away from the victim out the back door of the store. The jewelry cases are smashed and there's blood on some of the glass. The victim is wearing a blue sweater and grey pants, is female, weighs 120lbs and is 5'6" tall.
So what you have is an apparent homicide with many traditional sources of evidence in play. How would you begin to investigate this scenario?
Now imagine the following. You are lead to the scene of a computer intrusion at a local bank. You arrive at the office of a credit card manager and see the following:
A black dell optiplex 755 sits under a desk and a 19" monitor resides on the tabletop. An external hard drive is plugged in to the computer and resides on the tabletop, and you note a USB key plugged in to the USB hub on the monitor. A small HP MFC unit is plugged in and rests on a small table next to the desk. Some papers litter the desk along with a tabletop calendar, a rolodex and a phone and a blackberry. The computer is on, and has Microsoft Outlook 2003 open on the desktop along with excel, Internet Explorer and one of the banks internal applications for credit card management.
This is pretty typical. So, how do you begin your investigation? What's the major difference in the two scenarios ?
In scenario 1, you have appear to have no one to interview. You must examine the deceased, review tapes, interview acquaintances and so on.
In scenario 2, you have a person to interview. The credit card manager was obviously using the computer and someone decided to call you for one reason or another. You must be able to determine if they are the witness to the intrusion, the perpetrator or the victim. Or if they are all three!
Suppose in scenario 2 you conduct your interview before you touch the computer (which I always recommend). What questions do you ask? Questioning a person can be seen as a bit of an arcane art form. The goal is to get the interviewee to be forthcoming with responses. Many people get embarrassed easily and get defensive, especially if they know they did something they probably shouldn't have. We want them to be calm and accepting of us and our questions. So, set some ground rules with your own team first. A few helpful rules of interviewing could be:
1) Never accuse.
2) Keep your cool. Emotions play a larger role in system compromises than people believe.
3) Be aware of your body language. You must always be aware that your face, posture and hand play, are a huge role in gaining the trust of the interviewee.
4) Ask leading questions.
5) Listen. You can't learn anything if you're talking.
6) Be nice.
7) Get them talking and keep them talking until you have enough information to proceed appropriately.
With the information I provided in scenario 2, you have no way of knowing what has happened yet, however, I am willing to bet you have already made some assumptions and perhaps even made some hypotheses. This is a natural occurrence in the brain and it's not a bad thing, unless you fail to view every angle because you develop tunnel vision.
Assuming the credit card manager told you the following how would you proceed?
- They arrived at 7:45am
- They opened Outlook to check email, and read some mail
- They opened an excel attachment containing this month's stats
- They plugged in their blackberry to sync it
- They plugged in their usb key to copy files they were working on at home
- They opened IE and visited yahoo.com and started researching colleges for their teenage daughter who is looking at schools.
2 comments:
On interviewing, I've always found that someone is more forthcoming if you play a little stupid at first and ask them something they can explain or clarify for you. When they see how happy/impressed/excited you are that they were helpful they try to keep that feeling flowing through the rest of the interview.
On the computer investigation, I would start with the USB drive for two reasons. It should be a fairly quick exam and you could make the assumption that the manager's home computer is less secure than his office computer. It's possible he brought some malware into the business.
Oh, and I'd tell him to use Firefox too. :)
Great tip Matt and I certainly agree!
Good theory too, and one that's certainly not uncommon.
Post a Comment