Welcome to Lecture 2�of CIS 55

Incident Response &

Intro to Cryptography

How was �Lab 1?

Assignments for this week

Kali Linux

• Windows -
• VMWare https://www.stationx.net/how-to-install-kali-linux-on-vmware/
• WSL https://www.kali.org/docs/wsl/wsl-preparations
• Mac -
• https://www.kali.org/docs/virtualization/install-vmware-silicon-host/

Linux Command line

• Tutorial - https://ubuntu.com/tutorials/command-line-for-beginners
• Game - https://overthewire.org/wargames/bandit/

Today we are going discuss 2 topics

• Ethics
• Incident Response
• Introduction to Cryptography

Ethics

DO NO HARM

Ethics Overview

1. Should Terry Childs have been arrested?

2. Should Mr. Hague have been forced to resign?

3. Could be we have done the same things as Mr. Wesley Autrey?

​

Incident Response

Incident Response

• CSIRT: Computer Security Incident Response Team is an expert group that handles computer security incidents.
• Incident response coordinator: Individual often has overall responsibility for the security of the organization's information; responsible for management of the CSIRT prior to, during, and after an incident
• Chief Security Officer (CSO)
• Chief Information Security Officer (CISO)
• Information Systems Security Officer (ISSO)

​

Alert Tuning and �Mismatching Control to Threat�

• Alert Fatigue

Thousands of alerts emanating from security tools across the enterprise - it’s easy to become overwhelmed and miss important threats

• Mismatching Control to Threat

Devoting time and resources to implement security controls that are irrelevant to the threats the organization is trying to mitigate

For Example:

• Using firewalls to prevent data theft from applications that are allowed to operate through the firewall
• Using standard antivirus tools that to protect against zero-day attacks, APT

​

​

​

Assistance to CSIRT

• Organizational support personnel: Assist with a variety of non-technical issues that fall outside those that are addressed by the CSIRT core and technical support personnel
• Legal
• Human Resources
• Marketing / Communications
• Facilities
• Corporate Security

​

Incident Response Playbook

• A well-documented IR Playbook contains clear steps/roles and responsibilities:
• Preparation
• Detection
• Analysis
• Containment
• Eradication
• Recovery
• Post-incident Activity

​

You need to practice the way you fight, because you will fight the way you practice �

Incident Response �Plan

• You must test your IR Plan/Procedures:
• Validate steps
• Lessons Learned
• Build muscle memory

​

• Test approaches:
• Cyber Table Top - https://www.blackhillsinfosec.com/projects/backdoorsandbreaches/
• Pen Test events
• Process Review/Audit

​

Investigating Incidents

• Identify Scope: What data affected? Which systems?
• Identify Impact: Based on CIA Triad
• Identify Root Cause: How did this happen? What were the Indicators of Compromise? Identify sequence of events leading to incident.
• Incident Attribution: CSIRT or investigative body attempts to determine which organization was behind the attack. Nation-state Actors? Criminals? Hacktivists?

​

Incident Containment

• Physical containment: Physical connection to the network is removed from the system. Best for limited scope incidents.
• Network containment: Network administrator(s) modify switch configurations to limit the traffic on a subnet to other portions of the network. May require modification of configurations on individual switches.
• Perimeter containment: CSIRT contains network traffic at the perimeter firewall.
• Virtual containment: Contain incident via software defined infrastructure, Software Defined Networking, Infrastructure as Code, serverless cloud architectures

​

Eradication Strategies

• IMPORTANT: There is no surefire way to be 100 percent sure that all malicious code has been removed
• Network segmentation: Subdivide network into Virtual LAN(VLAN) segments
• Reimage affected machines: Restore to last known good configuration prior to incident
• Test new image:
• Ideally in air gapped Test environment
• Promote test image to Staging
• Retest in Staging environment
• Promote to Production

​

Incident Recovery

• Cyber hygiene check: Ensure that all systems (i.e., not only those that have been through the eradication phase) are properly patched with the most up-to-date patches
• Update alert profile: CSIRT coordinates with IT personnel to refine additional detection and prevention alerts
• Change review: Review changes made in response to incident and determine if emergency changes need to be permanent, or backed out from Production
• Vulnerability scan: Scan all assets in environment; remediate issues
• After Action Report: Document events of incident, identify recommendations / lessons learned

​

Legal Considerations

• Some applicable U.S. legal considerations
• Title 18, US Code (Fraud and related activity): addresses the use of a computer to commit fraud
• Computer Fraud and Abuse Act (CFAA): Primary cybercrime law in the U.S. Makes unauthorized access illegal
• Electronic Communications Privacy Act (ECPA): Amendment to the Federal Wiretap Statute makes illegal the unauthorized interception of communications through electronic means, such as telecommunications and the internet. 
• Communications Assistance for Law Enforcement Act (CALEA). Forces ISPS to make networks available to law enforcement agencies for lawfully authorized surveillance.

​

Digital Forensics Process

Identification

• Examples of trace evidence in digital world
• Firewall records
• Event logs (success/failure)
• IP packet captures
• Proxy logs

​

• CAUTION: Threat actors can manipulate digital evidence

​

Preservation

• Important to safeguard it from any type of modification or deletion
• Secure backups if all systems
• Enable controls that protect log files from removal or modification
• Isolate the system from the rest of the network (physical or logical controls, network access controls, perimeter controls)
• Make sure users are not able to access a suspect system
• Virtual machines: Take snapshot/backup of virtual systems affected and store in nonvolatile memory

​

Collection

• Collect volatile data to a non-volatile medium, such as an external hard drive
• Internet Engineering Task Force (IETF) order of volatility of digital evidence:
• Registers and cache
• Routing table, ARP cache, process table, kernel statistics, memory (RAM)
• Temporary filesystems
• Disk
• Remote logging and monitoring data
• Physical configuration, network topology
• Archival media

​

Examination

• Specific tools and forensic techniques that are used to discover and extract data from the evidence that is seized as part of an incident
• Memory images
• Desktop images
• Log file analysis
• Network captures

​

• Perform examination on a copy of the backup (vice the sole backup) – examination of data could result in contamination of evidence!

​

Analysis

• Analyze the data in light of any other relevant data obtained
• Example:
• A compromised host has an open connection to an external IP address, they would then correlate that information with an analysis of a packet capture taken from the network
• Using IP address as a starting point, the analyst would be able to isolate traffic
• Eventually find that compromised host is sending out a beacon to a C2 server

​

• FireEye investigation led to identification of SolarWinds incident

​

Presentation

• Reporting of facts related to digital forensics needs to be clear, concise, and unbiased

​

• Detailed written report that addresses every action and captures the critical data required
• Report should be thorough, accurate, and without opinion or bias
• May require court testimony
• Testifying in court may be required
• Testimony may include opinions/conclusions based on experience of the analyst

​

Cryptography

Have you ever written something or sent something online that you didn’t want someone else to see? Let us know in the chat

Story of Caesar’s Secret code

Caesar Secret Code (Cipher)

Caesar Secret Code (Cipher)

Codes on buildings ?

Have you ever seen building with symbols on them?

Freemason Ciphers

Encryption

Have you ever opened a file and seen something like this?

Let us know in the chat yes, no

Transpose Technique for Coding

Exercise

Steganography

• German Spy in World War II -

How did they send their secrets

• Sir John Trevanion locked up in Colchester Castle

How did he jailbreak?

​

​

Exercise

“APparently, nEutrals pRotest iS tHoroughly dIscounted aNd iGnored. IS mAn hArd hIt. BLockade iSsue aFfects pRetext fOr eMbargo oN bY pRoducts, eJecting sUets aNd vEgetable oIls.”

Exercise

At the time of the English Civil War, Sir John Trevanion was locked up in Colchester Castle in Essex (to the northeast of London). His fellow royalists Sir Charles Lucas and Sir George Lisle had just been executed and he was expecting the same fate. Then, the gaoler delivered him a letter.

Worthie Sir John, --Hope, that is ye beste comfort of ye afflicted, cannot much, I fear me, help you now. That I would saye to you, is this only: if ever I may be able to requite that I do owe you, stand not upon asking me. 'Tis not much that I can do: but what I can do, bee ye verie sure I wille. I knowe that, if dethe comes, if ordinary men fear it, it frights not you, accounting it for a high honour, to have such a rewarde of your loyalty. Pray yet that you may be spared this soe bitter, cup. I fear not that you will grudge any sufferings; only if bie submission you can turn them away, 'tis the part of a wise man. Tell me, an if you can, to do for you anythinge that you wolde have done. The general goes back on Wednesday. Restinge your servant to command. R.T.

Computer Assisted

• Binary
• Hexadecimal
• AES ECB

Enigma

Public Key Cryptography

• A public key is like a bank account number.
• A private key is like an ATM PIN.

Cryptography

• Cryptanalysis - ( kryptós, "hidden", analýein, "to loosen" or "to untie") is the study of how to analyze information systems in order to uncover the hidden aspects of these systems.
• Cryptanalysis = the science (art) of breaking encryption
• Cryptography = the science (art) of encryption
• Cryptology = cryptography + cryptanalysis

​

• Brute force key cracking—trying all possible keys until the cryptanalyst finds the right key.

Goal of Cryptography

Encryption – Prevent Eve from intercepting message

Authentication – Prevent Eve from impersonating Alice

​

Cryptography

• Cryptography is about constructing and analyzing protocols, which are designed to be extremely difficult for adversaries to break
• Cryptography problems involve various parties (humans, computers, gadgets, etc) playing the role as the good guys
• We design protocols for these parties to use
• The protocol tells each party how to behave and is typically a (distributed) program
• Note: Protocols tell the parties what to do, but not the adversary -- they can do anything

Symmetric key Cryptography

• Alice and Bob share a secret key, K_ab
• Encryption – Plaintext message is encrypted and decrypted with K_ab
• Authentication – Alice proves to Bob that she knows K_ab (e.g. a password)

​

Public Key Cryptography

• RSA = Rivest, Shamir, and Adelman (MIT), 1978 RSA is one of the first practical public-key cryptosystems and is widely used for secure data transmission.
• Bob generates 2 keys, K_eb and K_db
• Bob publishes K_eb (public key)
• Alice encrypts: �ciphertext C = E(K_eb, plaintext P)
• Bob decrypts: P = D(K_db, C)
• It must not be possible to compute K_db (private key) from K_eb

​

Digital Signatures

• Alice generates K_ea and K_da
• Alice publishes K_ea
• Alice signs plaintext P: (P, S = D(K_da, P))
• Alice sends P, S to Bob
• Bob verifies that E(K_ea, S) = P�(since only Alice knows K_da)

​

Game of Cryptography

• How do we devise and analyze protocols?
• The first step is to understand the threats and goals of our particular problem
• Once understood, we then attempt to find a protocol solution
• The adversary is the agent that embodies the source of the threat -- their goal is to defeat our protocol’s goals
• So it is a game -- whoever is more clever wins: the protocol designer or the adversary

​

• Cryptography is largely about thinking about the adversary -- what can they do? what is they trying to accomplish?

Crypto Attacks

• Ciphertext only: attacker has only ciphertext.
• Known plaintext: attacker has plaintext and corresponding ciphertext.
• Chosen plaintext: attacker can encrypt messages of his choosing.
• A cipher must be secure against all of these attacks.

​

Kerckhoffs’ Principle

• The security of an encryption system must depend only on the key, not on the secrecy of the algorithm.
• Nearly all proprietary encryption systems have been broken (Enigma, DeCSS, zipcrack).
• Secure systems use published algorithms (PGP, OpenSSL, Truecrypt).

​

Block Cyphers

• AES
• DES
• 3DES
• Twofish
• Blowfish
• Serpent
• RC4
• IDEA
• Etc.

Provable Security

• There is no such thing as a provably secure system.
• Proof of unbreakable encryption does not prove the system is secure.
• The only provably secure encryption is the one time pad: C = P + K, where K is as long as P and never reused.
• Systems are believed secure only when many people try and fail to break them.

​

Cryptographic Algorithms

• Block ciphers (secret/symmetric key)
• Hashes
• MAC (keyed hashes)
• Diffie-Hellman key exchange
• RSA (public key encryption and digital signature)

​

Data Encryption Algorithm (DES)

• 64 bit block
• 56 bit key
• Designed by NSA and IBM in 1976 for unclassified data
• Considered obsolete due to small key and block size
• 3DES increases key to 112 bits:

AES - Advanced Encryption Standard

• Replaces DES
• Selected by competition by NIST in 2001
• Reviewed by NSA and approved for classified data in 2003
• 128 bit block size
• 128, 192, or 256 bit key

Secure Sockets Layer (SSL)

• https protocol (secure channel)
• Version 3.0 developed by Netscape in 1996
• Also known as TLS 1.0 (Transport Layer Security)
• Supports many algorithms

Public Key: RSA, DH, DSA

Symmetric Key: RC2, RC4, IDEA, DES, 3DES, AES

Hashes: MD5, SHA

• Public keys are signed by CA (Certificate Authority) using X.509 certificates.

​

SSL

SSL Handshake

• A browser or server attempts to connect to a website (i.e., a web server) secured with SSL.
• The browser or server requests that the web server identifies itself.
• The web server sends the browser or server a copy of its SSL certificate in response.
• The browser or server checks to see whether it trusts the SSL certificate. If it does, it signals this to the webserver.
• The web server then returns a digitally signed acknowledgment to start an SSL encrypted session.
• Encrypted data is shared between the browser or server and the webserver.

​

Why do we need SSL certificates?

• Websites need SSL certificates to keep user data secure, verify ownership of the website, prevent attackers from creating a fake version of the site, and convey trust to users.
• If a website is asking users to sign in, enter personal details such as their credit card numbers, or view confidential information such as health benefits or financial information, then it is essential to keep the data confidential. SSL certificates help keep online interactions private and assure users that the website is authentic and safe to share private information with.
• More relevant to businesses is the fact that an SSL certificate is required for an HTTPS web address.

​

SSL Certificates help secure information, such as..

• Login credentials
• Credit card transactions or bank account information
• Personally identifiable information — such as full name, address, date of birth, or telephone number
• Legal documents and contracts
• Medical records
• Proprietary information

​

Weaknesses of certificates

• Not well understood by users (which CA’s do you trust?)
• CA private key could be leaked.

Perhaps, the best book ever written

Cryptography Summary

• Cryptography is hard

Security can not be proven.

Even expertly designed systems have weaknesses.

Designing your own encryption algorithm would be foolish.

• Cryptography is not the answer

Most attacks do not involve breaking encryption.

• Prevent, Detect, Recover

Cryptography is only for prevention

​

That’s all, folks