State of the Practice of Computer Security Incident Response Teams ...

and some of the tools that are used (SafeBack, 106 EnCase, 107 The Coroner’s Toolkit 108 )
[Schultz 02].
A large portion of Mandia’s Incident Response is devoted to forensics analyses (“Putting on
the Gloves”). This publication includes very specific and detailed descriptions for investigative
guidelines (conducting initial assessments to developing response strategies), handling
evidence, trap and trace guidance, and surveillance techniques. The book also has sections
that focus on specific platforms (Windows NT/2000, UNIX), other specific attacks, and how
to investigate incident activity [Mandia 01].
The SANS Incident Handling Step-by-Step guide also highlights the importance of understanding
and identifying every piece of evidence [SANS 03].
There are other books that focus solely on the issues of computer forensics [Caloyannides 01,
Kruse 02, Marcella 02]. Caloyannides focuses on providing information to law enforcement
professionals who need technical and procedural training to conduct forensic examinations
that will be admissible in court or for business professionals who want to ensure their information
is not stolen by anyone. It can also be used by the average reader to further their understanding
of technical issues related to computer forensics.
Kruse has organized his publication to provide an introductory course in computer forensics.
He suggests that the book can be used as a handbook. It covers evidence collection, tools, and
utilities that can be used in the process of investigating incident activity. It also provides
guidance on investigating activity involving Windows and UNIX computers.
Van Wyk [van Wyk 01] provides an overview of the “tools of the trade” that CSIRT incident
handlers might need to support their investigation of incident activity. He describes not only
the investigative tools used (network security monitoring tools) but also other communications
“tools” that may be needed during response activity. These tools may include wireless
or cellular access and other hardware/software needs, such as CD drives, tape drives, and
other removable media.
There seems to be no standard group in an organization that provides forensic analysis. We
have seen a wide variety of staff members perform this task. We have seen companies that
train their CSIRT staff to perform this type of work. We have also seen organizations that outsource
this capability, others that turn it over to law enforcement agencies, and others, particularly
government agencies, that turn it over to their investigative units.
106
107
108
CMU/SEI-2003-TR-001 101