Preserving Evidence After A Cyber Attack Or Ransomware Incident

INCIDENTEVIDENCE · AGUIDEFORUKLAWYERS Preserving Evidence After a Cyber-Attack or Ransomware Incident Recovering the Business Without Destroying the Case COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES INCIDENT EVIDENCE PRESERVATION INTRUSION TIMELINE RECONSTRUCTION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: recovery eats evidence 03 The first hours: what to preserve before anything is rebuilt 04 The intrusion evidence map: entry, movement, exfiltration, impact 05 Working with insurers, IR firms and the preservation gap 06 The legal audiences and their clocks: ICO, regulators, subjects, courts 07 From incident to litigation: the uses the estate must support 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : PRESERVEBEFOREYOUREBUILD : IMAGES , VOLATILEDATAAND LOGSCAPTUREDINTHEFIRSTHOURSSERVEEVERYAUDIENCETHEINCIDENTCREATES : ANDTHERECOVERYTHATSKIPSPRESERVATIONANSWERSREGULATORS , INSURERSAND COURTSFROMMEMORY § 0 2 · FIRSTPRINCIPLES The problem in plain English: recovery eats evidence § 0 3 · THEFIRSTHOURS The first hours: what to preserve before anything is rebuilt § 0 4 · THEINTRUSION ' SSTORY The intrusion evidence map: entry, movement, exfiltration, impact § 0 5 · THECROWDEDBRIDGE Working with insurers, IR firms and the preservation gap § 0 6 · THECLOCKS The legal audiences and their clocks: ICO, regulators, subjects, courts § 0 7 · THELONGTAIL From incident to litigation: the uses the estate must support § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION PLATFORM CLEARED / ENDPOINT NETWORK SECURIT Y EXTERNAL LAYER LAYER TOOLING LAYER IDENTIT Y / ATTACKER- LOGS LOST § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THE72 - HOURREPORTWRITTENFROMEVIDENCE EXAMPLE2 · THEREBUILDTHATERASEDTHESUPPLIERCLAIM EXAMPLE3 · THENEGATIVETHATWASWORTHPROVING § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client (in the first hours) Ask the IR firm / insurer panel Ask third parties (suppliers, MSPs, providers) SUGGESTEDWORDING · PRESER VAT IONMAN DAT EFORTHEIRENG AG EMENT § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The incident-preservation checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Won't preservation slow down our recovery when every hour of downtime costs money? Should we pay the ransom, and does forensics bear on it? How can we possibly know within 72 hours what data was affected? The attackers cleared the server logs. Is the investigation over? Our insurer's IR firm is handling everything. Do we need our own forensic adviser? Can we prove data was NOT taken? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY