Litigation Support

On September 1, the cybersecurity authorities of Australia, Canada, New Zealand, the United Kingdom, and the United States issued a joint advisory highlighting technical approaches to uncovering malicious cyberactivity, with suggested mitigation practices. One suggestion is to analyze data in various ways to identify normal traffic patterns, so that anomalous activity is more easily identified.

The advisory lists investigative steps to help identify suspicious activity. These include identifying file names that suggest data exfiltration, watching for new connections on previously unused ports, and detecting unauthorized connections to known threat indicators. The document highlights common mistakes in handling security incidents, warning against some immediate responses that might result in adverse consequences. For instance, you want to avoid tipping off threat actors (which might make them cover their tracks or take more serious actions such as activating ransomware) and changing data that might have helped analyze an attack.

The 14-page document highlights recommended investigation and remediation processes. These are divided into general mitigation guidance and pre-incident best practices. Best practices include defensive techniques and programs to make it more difficult for a threat actor to get persistent, undetected access to a network. Knowing that no single technique, program, or set of defensive techniques or programs will completely prevent attacks, the advisory recommends a layered approach with multiple defensive techniques and programs to provide a complex barrier to entry, increase the likelihood of detection, and decrease the likelihood of a successful attack.

Fourteen pages makes for relatively light reading. Coffee will help.

HT to Dave Ries.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.

3975 University Drive, Suite 225|Fairfax, VA 22030

Email: snelson@senseient.com Phone: 703-359-0700

Digital Forensics/Cybersecurity/Information Technology

https://senseient.com

https://twitter.com/sharonnelsonesq

https://www.linkedin.com/in/sharondnelson

https://amazon.com/author/sharonnelson