Has your organization been the victim of a cyber crime? If you’ve come to this page with questions about what next steps you should take, we are here to help. We know that the days following a cyber attack on your organization
can be confusing and you need answers on how the attack happened, how your data was affected, and how to move forward from here. A digital forensics investigation is the first step towards closure on your cyber incident.
Whether your data has been compromised by a cyber attack or your files encrypted by a cyber crime like ransomware, you want to know how the attack happened in your network.
The digital forensic experts at Proven Data have helped hundreds of organizations navigate the rough waters of a cyber attack and are ready to assist you.
A digital forensic investigation can help you answer any questions you might have about the attack including:
- What networks, systems, files, or applications were affected?
- How did the incident occur? (What tools and attack methods were used, vulnerabilities exploited)
- What data and information was accessed or stolen?
- Are hackers still on my network? (Is the incident finished or is it ongoing?)
- Where did the attack come from?
Cyber attacks can leave a business leader feeling unsure about the future and what actions they need to take to prevent a future attack from happening.
By the end of this blog, you will:
- Know what digital forensics is and what it’s used for.
- Understand how a digital forensics examination can uncover information on a cyber attack and help your business.
- Know the next steps you can take to find answers after your organization has experienced a cyber incident.
What is digital forensics?
Digital forensics describes a scientific investigation process in which computer artifacts, data points, and information are collected around a cyber attack. Computer forensics is a branch of digital forensics that focuses on extracting evidence from computers (sometimes these two forensics classifications are used interchangeably).
“The main goal of computer forensics is to identify, collect, preserve, and analyze data in a way that preserves the integrity of the evidence collected so it can be used effectively in a legal case,”
A digital forensic examiner’s job is to provide information such as:
- Identify an entry point used by the attacker into the network
- Identify what user accounts were utilized by the attacker
- Identify the duration of unauthorized access on the network
- Attempt to geolocate the logins and map them on a world map
The forensics investigator can then provide you with a written report in layman’s terms that outlined what the attacker did and the steps they took.
Cyber crimes are not easy to investigate because the crime scene exists in the digital world. Using an example we can all relate to: In the case of a home burglary, you might come home to find shattered glass and broken windows that would lead you to assume a crime was committed. In the cyber world, the evidence is much less obvious. It might even be difficult to determine how the cyber threat entered your network if the attackers attempted to hide their tracks.
What happens during a digital forensics investigation?
Maybe you’ve just been infected by ransomware and want to find out how your files were encrypted. A proper digital forensics investigation will help your organization draw more conclusions about the cyber crime and what happened on your network.
Digital forensics experts can explore your network and probe digital artifacts such as security event logs, network traffic, and access credentials to deliver closure on a cyber attack.
To understand how digital forensics works, the process of digital forensics can be broken down into 5 steps:
- Identification
- Preservation
- Analysis
- Documentation
- Presentation
Identification
This step is to establish the scope of the investigation and what goals and objectives need to be met. Identifying what evidence needs to be collected and the devices used (computers, network traffic logs, storage media devices) will guide the investigation and must be analyzed.
Preservation
Appropriate steps and actions are taken to ensure as much digital evidence as possible is preserved on the affected network.
Preservation is typically performed in the form of an image backup file. It is critical to use imaging software which utilizes “write blockers” to ensure there are no additional digital footprints left by the forensic examiner who is creating the image.
Once the image backup is created, all the evidence prior to the image has been captured.
Computers are constantly receiving and changing the information they store in the form of access logs, data backups, etc. If you don’t preserve these logs as soon as possible, the important information needed for the forensic investigation may be overwritten.
Although the forensics techniques vary, largely forensics investigators will extract digital artifacts such as:
- Event logs
- Packets of data
- Containers
The longer you wait to do the digital forensics investigation might mean that older data is overwritten and entry logs will change. Just like any crime scene, evidence gathered closer to the incident date will help investigators provide a more accurate picture of what happened.
Analysis
This is the real bread and butter of digital forensics. The data and digital artifacts collected throughout the investigation must be analyzed and pieced together to tell a full story of what happened during the cyber attack. Forensics investigators use tools and techniques to dig into the incident and create a timeline of events.
The analysis step of digital forensics is often the most murky and disputed in the practice. How can there be a set standard for what exactly is reliable facts from data? In 2020, many of the industry-standard best practices will be followed in the Global Information Assurance Certification (GIAC) program.
Digital forensics professionals use tools to inspect and extract the information they seek. An example can be a program (or script) used to try and identify different files on a network.
Documentation
The documentation step is where all of the evidence is collected and recorded as it pertains to the cyber crime at hand. A good digital forensics documentation only includes the most important and critical information needed to make an accurate conclusion. These findings are prepared in professional documentation (reports, graphs, pictures) and will be useful during the presentation stage.
Presentation
This is the most critical step in carrying out a quality digital forensics investigation. The presentation of findings and discoveries via documentation helps stakeholders understand the attack and what happened.
Digital forensics investigators will cite what happened during the attack and present it in a way that can be understood by people of many backgrounds. This is especially important as these findings may be used for internal investigations and audits for businesses following the cyber attack.
A common example is when data is presented where an attacker came from and plot the location on a global map.
Experienced digital forensics service providers will pore over every detail and leave no stone unturned to ensure more detailed information can be communicated to the victim.
What is digital forensics used for?
If your company was recently a victim of a cyber attack, it may be difficult to decide what the next course of action is. The digital forensics investigation can lead you in the direction to understand what information was compromised. Businesses that have experienced a cyber attack must understand the attack in full context to see what data was breached.
A digital forensics investigation is used for:
- Identifying the cause and possible intent of a cyber attack
- Safeguarding digital evidence used in the attack before it becomes obsolete
- increasing security hygiene, retracing hacker steps, and finding hacker tools
- Searching for data access/exfiltration
Victims of ransomware can use ransomware forensics services to determine how their network was infiltrated.
Why is digital evidence important?
“Digital evidence is information stored or transmitted in binary form that may be relied on in court” as outlined by U.S. National Institute of Justice. Organizations can collect and store very confidential data such as Personally Identifiable Information (PII), which is meant to be private and secured. This type of data is protected under privacy acts and data protection laws for consumers, and digital evidence can help trace where the information was copied or stolen.
In many local, state, and federal jurisdictions, your business must disclose if this information was compromised. Digital forensics is used to trace the cyber attack path and scrutinize every move the attacker made on your network.
A comprehensive digital forensics investigation will provide a report of any data that was copied or removed from the network. Your organization must become aware of this type of activity as it relates to breach notification laws, and if your company becomes liable to disclose this information. Only a proper digital forensics report can give you and your business leaders the further insight needed to make the data breach disclosure decisions moving forward.
Is my network still compromised?
Organizations that fail to perform a digital forensics investigation may risk the possibility that the attacker is still on your network. Even after a the resolution of a cyber attack, it does not guarantee the safety or security of your networks and data moving forward.
Digital forensics examiners can determine if there is still suspicious activity and alert you if steps need to be taken to mitigate those possible cyber threats.
Did the attacker look at or remove any files from my network?
Victims of a cyber attack should be curious to know exactly what actions were taken once an unauthorized user gains access to your files and network. A digital forensics examination can look more closely at which data became compromised during an attack.
Cyber threats like ransomware are designed to encrypt your files and lock access to this data. However, it is becoming increasingly popular for cybercriminals to exfiltrate or remove these files from the network. Cyber gangs are increasingly using more aggressive extortion techniques that include threatening to leak your data if a crypto ransom is not met.
Can you find out if my data was copied or sold?
Businesses should be concerned about their data and the information that might have been copied throughout the course of a cyber attack. Cybercriminals can withdraw your information from a network and use it for malicious purposes and intent. Your data may be leveraged on the dark web where stolen data is auctioned and sold to the cybercriminal economy.
Unfortunately, once a data breach occurs and the information was exfiltrated, there is no guarantee that the cyber attackers will not sell your information. However, a digital forensics expert can determine what has been exfiltrated from the network. Additionally, a digital forensics company may be able to estimate the likelihood that your data was leaked by utilizing threat intelligence from previous cases.
Will a digital forensics investigation help prevent a future cyber attack?
Maya Angelou famously said, “If you don’t know where you’ve come from, you don’t know where you’re going.” Victims of a cyber attack need to apply the same philosophy to their previous cyber incident to safeguard their data in the future.
While a digital forensics investigation does not prevent a future attack, a digital forensics examination can detect gaps that need to be filled in a security infrastructure.
These examinations can also provide an opportunity to identify additional security vulnerabilities that can be addressed proactively for the next time a hacker comes knocking on their doors.
Armed with vital intelligence from a digital forensics expert, you will be able to determine the next logical steps to take to ensure your cyber security. Whether or not you choose cyber security services from a team of experts, improving your cyber security after an attack is crucial.
Actively patching the cybersecurity vulnerabilities of your organization can:
- Reduce risks of malware entering your network.
- Keep your sensitive data from unwanted eyes.
- Reduce the potential of experiencing costly cyber attacks in the future.
Businesses seeking digital forensics services need to act fast to ensure the digital artifacts and evidence is best preserved for the investigations process. Organizations that wait a long time before beginning their digital forensics investigation risk the effectiveness of the forensics investigations, as data and evidence will be more difficult to obtain in an attempt to pinpoint the vulnerabilities.
The US Computer Emergency Readiness team has said, “Should an intrusion lead to a court case, the organization with computer forensics capability will be at a distinct advantage,” and we agree!
How can Proven Data help protect your business with digital forensics?
Now that you know what digital forensics investigations are and how they are accomplished, you are deciding if an investigation would be beneficial for you. We are standing by to help you make informed decisions.
At Proven Data, we always recommend that you seek legal advice to determine any specific regulatory requirements in your jurisdiction and, we are experienced with conducting investigations cooperatively with legal counsel to satisfy a variety of requirements.
Our digital forensics examiners have helped hundreds of organizations in the critical days following a cyber attack and provided them with a detailed report about the threat. Our digital forensics investigation processes and services can quickly and accurately help your business understand the scope of the cyberattack and walk you through the next steps for improving your data security.
