Cyber Black Box¶
Just as the flight recorder “black box” helps aviation investigators, the Cyber Black Box assists digital forensics investigators in piecing together the events leading up to a cyber incident.
A faster and more accurate resolution means better business outcomes – faster remediation, fewer repeat attacks, and even smoother cyber insurance claim
Why put the forensic logs in the backups?
Because backups are the perfect place to put them.
When forensic investigators try to piece together a timeline of events, they need to see how system activities change over time. That means understanding historic activities, such as network connections, registry and disk activity and setup. But by the time an investigator is called to deal with an incident, it’s already too late – the investigator might be able to get the current state of the machine, but not what happened in the past. Further, most likely the hacker has already wiped the evidence.
What investigators need the most is a historical record of key pieces of information – just like a black box flight recorder does on airplanes. Backups are designed to keep old versions of data, even if the current version is destroyed.
Recording and putting the information in the backups will
- Enable easy retrieval of historic forensic information that goes back days, weeks and months.
- Preserve the forensic information even if the current system is hacked into and disabled.
What information is recorded?
- Basic system and software version info
- Detailed system info via WMI (including storage, features, hotfixes, drivers)
- Disks and volumes – critical volumes, partitions information
- Network connections and activity – current connections, port listeners, routing table, network statistics
- Process list
- Volume Shadow Storage details – providers, snapshots, volumes, writers and writer states.