In consulting, all engagements begin with what we refer to as “scoping” in order to, at a very high level, determine if/how we may be able to help a client. Sure, they can sometimes be arduous or monotonous and often involve a comedy of conference call errors, but they are absolutely CRITICAL to the success of the engagement. So critical, in fact, that I wanted to take some purposeful time to address this often-overlooked, admittedly very unsexy, but nonetheless integral piece of performing effective DFIR.
Though I’m approaching this from a consulting point of view, this is in no way unique nor applicable only to consulting. So, don’t tune out now just because, “I don’t have clients.” You do, actually, whether they are external entities or people within your own organization. Each of us has “clients” in various forms that rely (often heavily) on us as DFIR professionals to ask the right questions and respond with the appropriate guidance and/or actions to mitigate threats and protect them from harm. As such, every DFIR professional will find themselves in situations where they must first comprehensively understand the problem(s) and issue(s) at hand before it can be effectively addressed in response and analysis. In fact, this is often where many of us find ourselves at the onset of an alert or suspected compromise that requires a well-formulated and concerted DFIR response. Though it can be very difficult to take step back and perform a high level assessment instead of diving right into action (especially when you may have external entities and/or higher level management wanting answers LIKE YESTERDAY), doing so will pay you back ten-fold.
At a lower level, scoping (or an initial assessment) must be performed as a due diligence effort to acquire all appropriate/pertinent information, addressing a variety of aspects that may affect the success, efficacy, or efficiency of the investigation. From my private sector experience dealing with a wide array of clients from all types of verticals, industries, and organizational sizes, I’ve attempted to unjustly distill the scoping topic and question set down a few (ok, a few more than a few) important bullets provided below.
However, do keep in mind that this is not intended to be all-inclusive set of questions to ask by any means. Rather, the below set of topics and specific questions are intended to serve as a solid baseline in facilitating comprehensive response and should be augmented or modified as needed. In addition, the below questions are from the perspective of me/us asking an external entity (i.e. client). So, feel free to change/replace the pronouns as well as instances of “the client” as needed for your use and application.
Purpose: Understand the background of the situation How did we (the client/organization) get here? When and how did they first notice any sort of issue? Can they think of any legitimate (non-malicious) causes for the current issue? Have there been any other anomalies either previous to or during the timeframe of concern that may be related to the current issue? Purpose: Understand what responsive actions have been performed to date Are the systems still running or have theybeen powered down? Have firewall blocks been put in place? (Tons more questions I ask…) Have any external entities been notified (particularly if under certain regulations)? Purpose: Understand the set of artifacts available to assist us in our response What type(s) of machines are involved (workstations/servers, OS)? Are they virtual or physical? Where are they hosted, and do they span disparate physical locations? What specific logging is enabled (host, network, and appliance)? …and which of the above are actually collected and available? …and do the available logs contain the right (useful) content? Let’s just say it is not uncommon to get “VPN logs” that simply show syslog interface up/down, “Web Logs” that contain only the load balancer as the “client-ip”, or “DNS logs” that aren’t logging query/response and logging only the IP of the DNS server as the “client”. …and do the available logs span the time frame(s) of concern/interest? Purpose: Identify the goals (in priority order) for the engagement Ask the question, “What would a successful engagement look like to you?” Is the client interested in simply getting back to business? Would they like a root cause analysis (how exactly did this get in/past their defenses)? If so, are they looking to specifically prove/disprove something? Are they simply looking to check a box (fulfilling some sort of requirement)? Often this will not be stated, but you can determine it by asking certain questions and gauging certain entities’ investment in the response. What would they like us to do, specifically, in priority order? Now, we don’t take this verbatim and slap it into a SoW, but we do use it to guide our response as best as possible to achieve their priority goals in tandem with an appropriate, comprehensive, and best practice response.Though it is not uncommon for a situation to merit even further questioning and level of excruciating detail, depending on complexity, the above set of topics are what I would consider the minimum requirements for a comprehensive initial assessment. Suffice to say that misunderstandings or simple lack of required information in any one of these areas can lead to a variety of undesirable consequences, ranging from that of a simply sub-optimal outcome to that of a completely disastrous one for both the company and the client.
The DFIR industry is a “pay now or pay later” industry, and this is no exception. As such, I highly encourage all of us to be purposeful in spending our time performing due diligence on the front end instead of paying the consequences of not doing so throughout our investigations.
/JP