Book Image

Digital Forensics and Incident Response

By : Gerard Johansen
Book Image

Digital Forensics and Incident Response

By: Gerard Johansen

Overview of this book

Digital Forensics and Incident Response will guide you through the entire spectrum of tasks associated with incident response, starting with preparatory activities associated with creating an incident response plan and creating a digital forensics capability within your own organization. You will then begin a detailed examination of digital forensic techniques including acquiring evidence, examining volatile memory, hard drive assessment, and network-based evidence. You will also explore the role that threat intelligence plays in the incident response process. Finally, a detailed section on preparing reports will help you prepare a written report for use either internally or in a courtroom. By the end of the book, you will have mastered forensic techniques and incident response and you will have a solid foundation on which to increase your ability to investigate such incidents in your organization.
Table of Contents (18 chapters)
Title Page
Credits
About the Author
About the Reviewer
www.PacktPub.com
Customer Feedback
Preface

Threat intelligence direction


There is a great deal of information and data points available to an organization in terms of threat intelligence. One of the major hurdles that organizations will have to jump is in determining what their threat intelligence requirements are. With the depth of threat intelligence available, it is necessary to sift out the noise and focus on only threat intelligence that drives action within the organization.

In determining an organization's threat intelligence requirements, it is advisable to examine what actors pose a threat to the organization and how those threat actors would conduct an attack against the organization's network. To determine this, there are resources such as the MITRE ATTACK methodology, the cyber-kill chain and diamond method that can aid an organization in determining what their threat landscape is like and better align their threat intelligence utilization to meet that threat.

Cyber kill chain

The cyber kill chain is a concept first authored...