Day 6: Incident Response, Digital Forensics & The Chain of Custody!

 

HELLO FRIENDS!!

WELCOME TO MY CYPHER LOG

   Guys in this blog I am going to share about what I have learned today and the blog is full of how we need to react before and  after an attack and also the golden rule of cybersecurity. So can we stop this introduction and start learning about this. 

Incident response

   When an attack happens we would call it a cyber incident.
Incident response life cycle
     The national industry standard has six phases for handling a cyber attack 

Preparation

   Preparation is when a natural disaster occurs and the government organised a preventive measures and also made preparation to reduce the damage before it happens so that's how this preparation works in organisations they will hire a trained staff  and have tools and policies before an attack happens.

Identification

  Identification is finding an attack already happened by some incidents like an alert from intrusion detection alarm and if a user reports as they receive a strange email.

Containment

    Containment is stopping the damage to spread like if someone had fever that could spread to others too so doctors prefer them to stay isolated that's how we must isolate the infected system from the network without turning it off because if we switched off the system it could lead to loss of data basically it's to preserve RAM data by doing this an attacker can't destroy the evidence.

Eradication

    It is removing threat, if there's any small bugs or destroyed leaves in plants we tend to remove that so we can save the plant that's how this eradication works by detecting malware or patching the vulnerability to prevent an attack.

Recovery 

    If an attack happened we need to totally clean the system and restore the data from the backup so that again the attack can't happen.

Lessons learned 

    It's like logging things we have already seen in our blog, here we need to write a report to be alert and prevent these things before it happens.
Next we come to the final part which is the golden rule,

The golden rule of cybersecurity - chain of custody

   Actually it will be used for those who try to become investigating officers like me ,
   This chain of custody is a documented unbroken trial that shows exactly who handled the evidence, when, where, and why from the moment it was collected until it is presented in court.
      If this chain is broken then they won't consider this as evidence.

Let's see how they maintain this chain of custody

   Officers arrive at the scene and take the photo of the laptop in the exact state then writes down the serial number, make and model of those systems then keep the evidence in evidence bag seal it and signs across the seal then kept it in the evidence room and note down date and time and about the officer who bring that.
This is how it actually happens.

So that's it guys let's see in other topics I hope you guys found it helpful.

If you want study guide to learn more about this you can get through this site

                                  THANK YOU

Comments

Post a Comment

Popular posts from this blog

Day 2: Understanding the CIA Triad, AAA

Image
HELLO FRIENDS!! WELCOME TO MY CYPHERLOG Today I studied the fundamentals of cybersecurity - the CIA Triad and AAA Framework. by journaling this in this blog I pushed myself to be stay productive  it's really motivating me!! Let me break down what I learned in simple terms.   At first I have started with CIA Triad and AAA Framework actually this the basic foundation of cybersecurity so we need to understand it well to master it, as you thing its not an complicating topics because I too thought that, its just an simple topic which we can easily connect with our daily life, so let me explain it clearly. THE CIA TRIAD    CIA Triad is nothing but a combined term of three words which is CONFIDENTIALITY, INTEGRITY AND AVAILABILITY and we can call it as an three pillars of cybersecurity so let see how it is more important in cyber. CONFIDENTIALITY  CONFIDENTIALITY is, if you are authorized to the system or data like we can take our mobile or laptop as an example you're ...
Read more

Cryptography Basics: Encryption Types & Hashing Explained

Image
 HELLO FRIENDS WELCOME TO MY CYPHER LOG         Today I came up with a topic which I wondered about what it will be from the first year of my studies in cybersecurity, The cryptography.  In this blog we are going to un-wrap this topic and learn more about it. LETS GET INTO THE TOPIC CRYPTOGRAPHY     You may think that it can be difficult to learn but actually there's nothing like that because I too thought like that about this, if you still think it's difficult I will explain it Like you want.    Cryptography is encrypting data from a readable plain text to unreadable cipher text format. Cryptography is like a knife It has both advantages and disadvantages. Its purpose varies based on who uses it, if you want to use it to protect data it can keep it secure, On the other hand if an attacker uses it he can create a massive bad impact like implement the attack the ransomware. THE TWO MAIN TYPES OF CRYPTOGRAPHY     As I have mentio...
Read more

Cyber Security Day 4: Understanding Layered Security & Defence in Depth

Image
HELLO FRIENDS!! WELCOME TO MY CYPHER LOG Successfully I have learned continuously for three days without any procrastination and I am just feeling proud of myself,  I hope you guys too learn continuously without any distractions. Ok let's see what I have learned today,    In the last blogs we have seen about security controls in this blog we are going to dive into depth of defence in cyber security and also there is an architecture called zero trust, let's see how it works. Defence in depth    Security controls are just a single safety measure to prevent an attack but defence in depth are not like that as we can understand with the name itself it's controlling structure which will protect the asset from an attack layer by layer. And it has five layers.  If a company hosts a website they won't just rely on a single layer of security like five layers of controls Layer 1 is an external firewall that will automatically block the IP address which looks suspiciou...
Read more