Investigating incidents Sample Clauses

Investigating incidents. All students will be required to write an incident form and some may be verbally asked questions to verify or clarify their statements. This information will be collated and carefully examined before any decisions are made. We will ensure that relevant staff receive adequate and appropriate training for the conduct of any investigations, including in respect of the recording of evidence and the taking of incident statements. • We will provide adequate non-contact time for the conduct of investigations. • We will notify the police and other relevant bodies of incidents where it is appropriate to do so. • We will complete all investigations within a reasonable timescale which will not normally exceed five days. • We will ensure that appropriate feedback from any investigation undertaken is provided to relevant persons together with recommendations for action. • We will offer anonymity where possible, but this may not always be viable.

Investigating incidents. “Post Mortem” Detection Computer security incidents can be detected either on the network layer or on the compromised host. In both cases the following steps have to be taken: Evidence for a security incident: Is the recorded event really a security incident or does it only look like one? For example, a legitimate traffic rush might cause an anomaly on the network. Therefore, the first step is to find evidence of a compromise or malicious event. Extent of the incident: The extent of the incident must be investigated. The incident often affects more than one host. As compromised machines are usually abused to attack other systems on Internet, it is crucial to determine the full extent of an incident. This can be done in the following ways: ○ Analysis of netflows: If the incident was detected on the network layer, the netflows from and to the affected host or network reveal other involved systems. For example, the netflows to an attacked host can identify hosts that are involved in a DDoS attack. The same technique can be applied to explore the extent of a botnet following the netflows to or from the C&C server. ○ Forensic analysis of a compromised host: This aims to identify the vulnerability which has been abused in order to compromise the system. The vulnerability needs to be known to recover from the incident without taking the risk of a re- infection. The forensic analysis also aims to explore the activity of the attacker on the compromised system. This may reveal malware or recorded logfiles the attacker left behind, which can be used to identify other systems affected by the incident.