Electronic Communications Privacy Act
(ECPA) of 1986 

The Electronic Communications Privacy Act of 1986 governs the privacy and disclosure, access, and interception of content and traffic data related to electronic communications.

Requires both parties to consent to the recording of a conversation. 

Basic subscriber information—This information includes name, address, billing information including a credit card number, telephone toll billing records, subscriber’s telephone number, type of service, and length of service. An investigator can obtain this type of information with a subpoena, court order, or search warrant.

Transactional information—This information includes websites visited, email addresses of others with whom the subscriber exchanged email, and buddy lists. An investigator can obtain this type of information with a court order or search warrant.

Content information—An investigator who has a search warrant can obtain content information from retrieved email messages and also acquire unretrieved stored emails.

Real-time access—To intercept traffic as it is sent or received, an investigator needs to obtain a wiretap order.

Law that includes a provision permitting the wiretapping of VoIP calls. 

The Communications Assistance to Law Enforcement Act of 1994 is a federal wiretap law for traditional wired telephony. It was expanded in 2004 to include wireless, voice over packets, and other forms of electronic communications, including signaling traffic and metadata.

/var/log 

This directory has many logs in it. The /var/log/daily.out contains data on all mounted volumes, including the dates they were mounted. This is very important in cases involving stolen data. You can see what devices have been attached and get data from them. This folder includes data on removable media, including serial numbers.

/var/spool/cups

In this folder, you will also find information about printed documents. If you need to know what documents have been printed from this Apple device, this folder can give you that information. This includes the name of the document printed and the user who printed it.

/Library/Receipts 

This folder contains information about system and software updates.This might be of some

interest in investigating malware crimes.

The Wireless Communications and Public Safety Act of 1999 allows for collection and use of “empty” communications, which means nonverbal and nontext communications, such as GPS information.

The USA PATRIOT Act

The USA PATRIOT Act is the primary law under which a wide variety of internet and communications information content and metadata is currently collected. Provisions exist within the PATRIOT Act to protect the identity and privacy of U.S. citizens.

Warrants are not needed when evidence is in plain sight. Courts have held that only the actual owner of a property can grant consent, or someone who has legal guardianship of the owner.  For example, a parent of a minor child can

grant consent to search the child’s living quarters and computers.

Integrated Drive Electronics (IDE) 

Because the data is stored magnetically, the drives are susceptible to magnetic interference. This can include being demagnetized. If a drive has been demagnetized, there is no way to recover the data. You should transport drives in special transit bags that reduce electrostatic interference. This reduces the chance of inadvertent loss of data.

Most SSDs use Negated AND (NAND) gate–based flash memory, which retains memory even without power. Because there are no moving parts, these drives are

usually less susceptible to physical damage than magnetic drives are. The startup time for SSDs is usually much faster than for magnetic storage drives.

First and foremost, it is one-way, not reversible. That means you cannot “unhash” something. The second characteristic is that you get a fixed-length output no matter what input is given. The third is that the algorithm must be collision resistant. A collision occurs when two different inputs to the same hashing algorithm produce the same output (called a hash or digest).

Cryptographic hashes are how many systems, including Microsoft Windows, store passwords. For example, if your password is “password”, then Windows will first hash it, producing something like this:

0BD181063899C9239016320B50D3E896693A96DF

Windows will then store that hash in the SAM (Security Accounts Manager) file in the Windows System directory.

The command prompt in Mac OS is a BASH shell

so you can execute Linux commands.

The GUID Partition Table is used primarily with computers that have an Intel-based processor. It

requires OS X v10.4 or later. Intel-based Mac OS machines can boot only from drives that use

the GUID Partition Table.

As the name suggests, these are logs of system audits. This includes things like user login. Obviously, this can be very interesting forensically. These audits are often not in a human-readable format. However, Guidance software makes an audit log parser for Mac OS

audit logs,

This folder contains swap and sleep image files. If you hibernate your Mac, this directory will

usually occupy more than 5 gigabytes of disk space. This can be a source of important forensic

data.

This folder is what syncs with iCloud. This is where you will find items that have been saved to

iCloud. It should be quite clear that this can be very interesting forensically.

In this folder, you will find a subfolder named app profile. This will contain lists of recently

opened applications as well as temporary data used by applications. Both of these can be very

interesting in a forensic examination.

This is where various users’ files are stored. It is always a good idea to check in this directory to

find out if users have saved data here that could be used as evidence.

As you probably suspect, this folder contains user preferences. This folder even maintains the

preferences of programs that have been deleted. This could be a very valuable place to get

clues about programs that have been deleted from the system.

Recall that in Windows systems, deleting actually just removes a file from the master file table

(MFT) or file allocation table (FAT) and marks those clusters as available. The file’s data is still

there and can be recovered. What happens when a file is deleted on an HFS or HFS+ volume?

Although the details are a bit different, a similar thing occurs. The references to the file are gone

and the clusters might be used and overwritten. But, depending on how soon after the deletion

you attempt to recover data, you may be able to recover some or all of the data. Even if the data

is overwritten, data may still exist in unallocated space and in index nodes. When a file is

deleted in Mac OS, it is moved to the Trash folder—much like the Recycle Bin in Windows. The

Trash is represented on the file system as a hidden folder, .Trash, on the root directory of the file

system.

Data Doctor—This product recovers all Inbox and Outbox data and all contacts data, and has

an easy-to-use interface. Most important, it has a free trial version, but there is a cost for the full

version.  [know this as a spoiler answer]

Forensics for a Windows 10 phone is done in much the same way as forensics for a Windows

10 PC or laptop is done. 

Pwnage—This utility allows you to unlock a locked iPod Touch and is available from

https://pwnage.com/. [know it as a spoiler answer]

.pst (Outlook)
.ost (Offline Outlook Storage)

.mbx or .dbx (Outlook Express)

.mbx (Eudora)

.emi (common to several email clients)

Exchange Server (.edb)

Exchange Public Folders (pub.edb)

Exchange Private Folders (priv.edb)

Center for Internet Security (CIS) Benchmarks

The Center for Internet Security (CIS) benchmarks are a set of security configuration best practices developed by a consensus community of experts. They provide a secure baseline configuration for various operating systems, applications, and hardware devices. The benchmarks define best practice approaches to patching, hardening, and system logging and are the industry standard for secure configuration.

Several vulnerability scanners, such as the licensed version of Tenable's Nessus scanner, include configuration scanning options to compare an endpoint's active configuration to the settings detailed in a CIS benchmark.

Open Web Application Security Project (OWASP)

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of web applications and services. It is an international organization that provides unbiased, practical information about application security. The OWASP provides tools, documents, and other resources to help people build more secure software.

internal scans focus on the view from the "inside."

Internal scans are also important to protect systems from abuse from internal threats and to provide layered security. For example, if an attacker makes it past external protections, their job should still be difficult even if they have made it to the "inside." Internal scans should include detailed, comprehensive vulnerability information

Hardware or software configured with a list of known weaknesses and exploits and can scan for their presence in a host OS or particular application.

An infrastructure vulnerability scanner is a type of software that scans network hosts (client and servers) and intermediate systems (routers, switches, access points, and firewalls) for data such as patch level, security configuration and policies, network shares, unused accounts, weak passwords, rogue devices, antivirus configuration, and so on. A scanner can be implemented purely as software or as a security appliance connected to the network.

Noncredentialed scans are simple to implement, produce a relatively low impact on the device, and provide insight regarding what vulnerabilities are discoverable to non-authenticated users, for example, someone with access to the network only

Credentialed scans provide the most comprehensive evaluation of devices. By authenticating to the device, the scanner can enumerate all installed software, the file system, configuration data, user accounts, and many other attributes. Special care is needed when using credentialed scans, as the most effective scanner credentials also have privileged access. If the scanner does not correctly protect the credentials, or if staff are not careful to protect the credentials, they can be abused or potentially exposed and stolen. Accounts such as root, Domain Administrator, or Administrator are inappropriate for vulnerability scanning. Scanning endpoints should be done with purpose-specific and carefully provisioned credentials, granting only the necessary access.

§ Passive scanning describes methods used to identify vulnerabilities without direct interaction with a device or software. The primary example of this is network packet capture. By inspecting the traffic to and from a device, issues such as insecure protocols, cleartext credentials, inadequate encryption methods, DNS query data, and other problems are easily identifiable.

The scope of a scan refers to the range of hosts or subnets included within a single scan job. The scope is configured in the scan as a single IP address or range of IP addresses. For a large network, it is sensible to schedule scans of different portions of the network to occur at different times. This will reduce the impact on network performance and make it easier to analyze the results of each scan. Scans of limited scope can also be used to identify particular issues or meet a particular compliance goal. Asset criticality might also affect scanning scope, with targeted scans of critical assets being scheduled more often.

Map/Discovery Scan

Identifying the type and version of an operating system (or server application) by analyzing its responses to network scans.

Fingerprinting describes the effort taken to more specifically identify details about a device. Whereas a map or discovery scan looks for connected devices, a fingerprint scan looks to focus attention on an individual device to better understand its purpose, vendor, software versions, configuration details, and the existence of vulnerabilities.

The process of reviewing uncompiled source code either manually or using automated tools.

Static analysis can be performed in a variety of ways. One method involves manual inspection of source code in order to identify vulnerabilities in programming techniques. Another approach uses specialty applications or add-ons to development tools that are designed to look for well-known programming methods and constructs that are known to be problematic.

The process of analyzing the structure of hardware or software to reveal more about how it functions

Reverse engineering describes deconstructing software and/or hardware to determine how it is crafted. Reverse engineering's objective is to determine how much information can be extracted from delivered software

Reverse engineering is not limited to software. Hardware can be reverse engineered to better understand how it operates in order to insert malicious components, for the theft of intellectual property, and/or to carefully inspect how a device operates in order to confirm it meets security requirements or to determine if it has been tampered with. Reversing can be performed on all nature of devices, and some examples might include security tokens, computer equipment, network and wireless equipment, cars, wearables, IoT devices, and many others.

Compliance Scans and Regulatory Requirements

Legal and regulatory environments will usually be accompanied by a security framework or checklist of the controls and configuration settings that must be in place. Security software products such as IDS, SIEM, and vulnerability scanners can often be programmed with compliance templates and scanned for deviations from the template.

Some sources of external compliance may dictate a scanning frequency that your organization must follow; others take a more hands-off approach and simply require that you have a plan in place to scan at certain intervals. 

Center for Internet Security

(CIS) benchmarks

CIS Benchmark configuration guides can be downloaded for free for non-commercial use and include detailed descriptions of all configuration points, although the documents are very lengthy to use in this way https://www.cisecurity.org/cis-benchmarks/. CIS offers a software tool for checking configurations, called CIS CAT, but access to the tool is limited to CIS Members. CIS Benchmarks™ are also available within the professional version of the Tenable Nessus vulnerability scanner, and CIS hardened images are available for deployment within major Cloud platforms, such as AWS or Azure.

Segmentation

This segmentation has a performance benefit and a security benefit because traffic flows between zones are more predictable and easier to monitor and filter. When you perform vulnerability scanning across a segmented network, you need to consider the requirements and limitations:

§  A server-based scanner must be able to communicate with remote subnets, possibly including multiple VLANs, and through one or more firewalls. Alternatively, multiple scanning host nodes can be deployed in multiple segments and configured to report back to a central management server.

§  An agent-based scanner must be able to communicate reports to the management server.

Performance Considerations

§  Identification of Operating System - Identifying the operating system of the target system is essential to ensure that the correct vulnerability scans used and to identify any unsupported or non-compliant operating system versions.

§  Scanning Interval - Scanning should be done regularly to identify new vulnerabilities. Scans should agree on an automated schedule or use specialized agents that support near real-time vulnerability identification.

§  Scan Speed - The scan speed is important as it can affect the accuracy of scan results. If a scan is too slow or too fast, it may miss important vulnerabilities and produce inaccurate results or overwhelm the target system resulting in negative performance impacts and downtime.

§  Vulnerability Database - The accuracy of the scan results depends on the quality of the vulnerability database used. It is essential to use a comprehensive and up-to-date vulnerability database prior to performing a vulnerability scan.

§  Scanning Type - Different types of scans can be performed to identify vulnerabilities in the target system. These include port scans, vulnerability scans, and comprehensive security configuration scans. 

§  Authentication - Authenticated scans are more comprehensive as they identify vulnerabilities using an authenticated session and have greater access to the host and software for deeper inspection. Unauthenticated scans have less performance impact on the target system but produce limited results compared to authenticated scans.

§  False Positives  -False positives are sometimes generated when vulnerability scans are performed. False positives represent invalid warnings generated by a scanner and waste the analyst's time researching and verifying the results.

Vulnerability Scan Scheduling 

Scheduling vulnerability scans is essential to maintaining a secure environment and is often required to maintain regulatory compliance. Vulnerability scans help identify system weaknesses that malicious actors may exploit. By scheduling scans regularly, organizations can ensure that any newly discovered vulnerabilities are identified and addressed before they can be exploited. Regular vulnerability scans also help ensure that installed patches are effective and do not introduce new vulnerabilities. Additionally, vulnerability scans help identify misconfigurations and unauthorized changes. Scheduling vulnerability scans is important to ensure that an organization's systems and networks remain secure.

Operations

Vulnerability scanning can unfortunately cause problems such as negatively impacting a system's performance or causing services to crash. For these reasons, it is important to carefully consider the needs of the organization prior to performing any type of vulnerability scan. It is common for vulnerability scanning activity to follow standard change management procedures to ensure all impacted parties are aware of scanning activity and the potential for problems.

Data Sensitivity Levels 

A data inventory, or data map, describes the mechanisms used to identify and track the data assets created, controlled, or maintained by an organization. The data inventory describes the data in terms of what it contains, such as intellectual property; customer data; third-party, confidential business data; and others, as well as its classification and sensitivity. Having a clear view of data is the first step in protecting it. Gaining full visibility is hindered by the complexity and dynamics of how data is stored as well as obtaining clear information regarding what each piece of identified data represents.

Communications network designed to implement an industrial control system rather than data networking.

Operational technology (OT) is a term used to describe the hardware and software technologies used to manage physical devices, processes, and events within an organization. It is the type of technology used to monitor and control actual physical systems, processes, and events in the environment. Examples of OT include industrial control systems, robotics, sensors, Programmable Logic Controllers (PLCs), and SCADA systems, as well as the networks and devices used to operate them.

Type of industrial control system that manages large-scale, multiple-site devices and equipment spread over geographically large areas from a host computer

A supervisory control and data acquisition (SCADA) system takes the place of a control server in large-scale, multiple-site ICSs. SCADA typically run as software on ordinary computers, gathering data from and managing plant devices and equipment with embedded PLCs, referred to as field devices. SCADA typically use WAN communications, such as cellular or satellite, to link the SCADA server to field devices.

Scheme for identifying hardware devices, operating systems, and applications developed by MITRE.

Uses a syntax similar to Uniform Resource Identifiers (URI). CPE is a standardized naming format used to identify systems and software.

Scheme for identifying vulnerabilities developed by MITRE and adopted by NIST

A list of records where each item contains a unique identifier used to describe publicly known vulnerabilities. Unique identifiers begin with CVE, followed by the year of identification, and a unique number - CVE-YEAR-#####.

Scheme for provisioning secure configuration checks across multiple sources developed by MITRE and adopted by NIST.

Similar to CVE, except focused on configuration issues which may result in a vulnerability.

OpenSCAP is an open-source scanner used to identify system vulnerabilities. It also provides the ability to calculate a CVSS score based on the vulnerabilities identified in the system. 

SecurityScorecard is a cloud-based solution that enables organizations to assess and improve their security posture. It also provides the ability to calculate a CVSS score based on the vulnerabilities identified in the system

Vulnerability Scans

Vulnerability scans check for open ports, protocol compliance, misconfigured firewalls or routers, unpatched software, cross-site scripting (XSS) problems, SQL injection weaknesses, and many other issues. The vulnerability scanning software creates simple informative output or a formal report identifying the vulnerabilities it discovered. Scan targets can include an individual system, a subnet, or logical grouping of assets, such as database, web, application servers, or perhaps industrial control systems. It is essential to save reports to establish trends over time that demonstrate the effectiveness of the vulnerability management program.

§  Assesses the likelihood that an attacker will be able to weaponize a vulnerability to achieve their objectives. This metric considers factors such as the attack vector (AV) and attack complexity (AC) which affect the ease with which an attacker can create a functional exploit. An attacker can easily use weaponized exploits to gain unauthorized access to a system, steal sensitive information, or carry out other malicious activities. Additionally, attackers can easily share weaponized exploits for others to use.

A zero-day represents an exploitable vulnerability with no available patch.

The lack of available patch is caused either because the vulnerability is new, and a patch is not yet available, or because the vulnerability is entirely unknown to the software provider.

These vulnerabilities are highly valuable to attackers. Standard vulnerability scanning techniques cannot detect unknown zero-day exploits because the scanner depends upon a vulnerability database of known vulnerabilities. 

§  An asset's value may influence a vulnerability's score. Highly valuable assets, like those with far-reaching impacts if breached, may have little tolerance for vulnerabilities, skewing all scores into the high/critical range.

CVSS Score Calculations

Categories

§  Impact—The potential damage or harm caused by the vulnerability.

§  Exploitability—The ease and likelihood of exploiting a vulnerability.

§  Remediation—The cost and effort required to fix the vulnerability. 

CVSS Score Calculations

Metrics:

§  Scope—The number of systems and people affected by the vulnerability. 

§  Confidentiality—The extent to which data is disclosed.

§  Integrity—The extent to which the system's functionality is changed or impaired. 

§  Availability—The extent to which a system is unavailable.

§  Privacy—The extent to which the system's privacy is impacted.

§  Operations—The extent to which the system's security is affected. 

§  Other—Any other relevant or important factors.

Increased awareness—A vulnerability management program helps organizations identify potential weaknesses in systems, software, and networks to help organizations reduce their risk of cyberattacks and ensure that the environment remains secure. 

Vulnerability Management Reporting Benefits 

Improved response

Vulnerability Management Reporting Benefits 

Improved security posture

Vulnerability Management Reporting Benefits 

Better compliance

Compliance Reports 

Compliance reports provide a detailed overview of how an organization is adhering to the laws, regulations, and standards that apply to its operations. They are typically used to evaluate the effectiveness of an organization's compliance practices, assess the organization's compliance with applicable laws, and provide important information to stakeholders and regulators. Organizations can use compliance reports to demonstrate their commitment to compliance and help ensure that legal and regulatory requirements are being followed. 

KPIs help organizations measure progress toward goals and identify areas for improvement in operations. Any stage of the cybersecurity lifecycle can use KPIs—prevention, detection, or response. KPIs are essential for organizations to understand how their cybersecurity efforts are performing, and they can also use them to determine areas where the organization needs to improve.

KPIs provide this data by tracking metrics, such as the number of security incidents and the time it takes to detect them. KPIs also allow organizations to compare their cybersecurity efforts against other organizations and industry averages. This comparison can help identify where cybersecurity efforts are exceeding expectations and areas where they need to catch up. By tracking KPIs, organizations can determine if additional cybersecurity staff or equipment resources are required or if existing resources are working sufficiently.

Examples of KPIs

Incidents

This KPI indicates the number of incidents an organization experiences, such as data breaches and cyberattacks. Organizations can track this KPI over time to determine if there is an upward or downward trend in incidents. 

Examples of KPIs

Detection Time

§  This KPI indicates the average time it takes to detect incidents. Organizations can use this metric to track how their incident response efforts are improving over time. They can also compare the detection time to industry averages to see where they can improve. 

Examples of KPIs

Indicators of Compromise (IoCs)

§  This KPI indicates the number of IoCs that organizations have in their systems and networks or that they have identified in others' systems. Organizations can track this KPI over time to determine if the IoCs are increasing in their environment. 

Examples of KPIs

Threats

§  This KPI indicates the number of threats organizations know about and have identified. Organizations can track this KPI over time to determine if the number of threats increases. 

Examples of KPIs

Risk Assessment

§  This KPI indicates the organization's risk assessment results. Organizations can compare their risk assessments with those of other organizations to see if they are on par. 

Examples of KPIs

Resource Allocation

Service Level Objectives (SLOs)

Service level objectives (SLOs) are essential in any customer-oriented operation. SLOs provide a benchmark by which security operations can measure their performance and help ensure they meet leadership's expectations. Service level objectives must be measurable, achievable, and realistic, like any goal-setting initiative. This means that security operations teams should set targets that are attainable but also challenging enough to foster growth. Additionally, SLOs should be flexible and adaptable as the cybersecurity landscape and organization's capabilities change over time.