Network Evidence Collection

3
The traditional focus of digital forensics has been to locate evidence on the host hard drive.
Law enforcement officers interested in criminal activity such as fraud or child exploitation
can find the vast majority of evidence required for prosecution on a single hard drive. In the
realm of incident response though, it is critical that the focus goes far beyond a suspected
compromised system. For example, there is a wealth of information to be obtained within
the points along the flow of traffic from a compromised host to an external C2 server.

This chapter focuses on the preparation, identification, and collection of evidence that is
commonly found among network devices and along the traffic routes within an internal
network. This collection is critical during an incident where an external threat source is in
the process of commanding internal systems or is in the process of pilfering data out of the
network. Network-based evidence is also useful when examining host evidence as it
provides a second source of event corroboration, which is extremely useful in determining
the root cause of an incident.

Preparation
The ability to acquire network-based evidence is largely dependent on the preparations that
are undertaken by an organization prior to an incident. Without some critical components
of a proper infrastructure security program, key pieces of evidence will not be available for
incident responders in a timely manner. The result is that evidence may be lost as the CSIRT
members hunt down critical pieces of information. In terms of preparation, organizations
can aid the CSIRT by having proper network documentation, up-to-date configurations of
network devices, and a central log management solution in place.
Network Evidence Collection

Aside from the technical issues regarding log management, there are legal issues that must
be addressed. The following are some issues that should be addressed by the CSIRT and its
legal support prior to any incident:

Establish logging as a normal business practice: Depending on the type of

business and the jurisdiction, users may have a reasonable expectation of privacy
absent any expressly stated monitoring policy. In addition, if logs are enabled
strictly to determine a user's potential malicious activity, there may be legal
issues. As a result, the logging policy should establish that logging of network
activity is part of the normal business activity and that users do not have a
reasonable expectation of privacy.
Logging as close to the event: This is not so much an issue with automated
logging as logs are often created almost as the event occurs. From an evidentiary
standpoint, logs that are not created close to the event lose their value as evidence
in a courtroom.
Knowledgable personnel: The value of logs is often dependent on who created
the entry and whether or not they were knowledgable about the event. In the case
of logs from network devices, the logging software addresses this issue. As long
as the software can be demonstrated to be functioning properly, there should be
no issue.
Comprehensive logging: Enterprise logging should be configured for as much of
the enterprise as possible. In addition, logging should be consistent. A pattern of
logging that is random will have less value in a court than a consistent pattern of
logging across the entire enterprise.
Qualified custodian: The logging policy should name a data custodian. This
individual would speak to the logging and the types of software utilized to create
the logs. They would also be responsible for testifying to the accuracy of the logs
and the logging software used.
Document failures: Prolonged failures or a history of failures in the logging of
events may diminish their value in a courtroom. It is imperative that any logging
failure should be documented and a reason is associated with such failure.
Log file discovery: Organizations should be made aware that logs utilized within
a courtroom proceeding are going to be made available to opposing legal counsel.
Logs from compromised systems: Logs that originate from a known
compromised system are suspect. In the event that these logs are to be introduced
as evidence, the custodian or incident responder will often have to testify at
length concerning the veracity of the data contained within the logs.

[ 57 ]
Network Evidence Collection

Original copies are preferred: Log files can be copied from the log source to
media. As a further step, any logs should be archived off the system as well.
Incident responders should establish a chain of custody for each log file used
throughout the incident and these logs are maintained as part of the case until an
order from the court is obtained allowing their destruction.

Network device evidence

There are a number of log sources that can provide CSIRT personnel and incident
responders with good information. A range of manufacturers provides each of these
network devices. As a preparation task, CSIRT personnel should become familiar on how to
access these devices and obtain the necessary evidence:

Switches: These are spread throughout a network through a combination of core

switches that handle traffic from a range of network segments and edge switches
that handle the traffic for individual segments. As a result, traffic that originates
on a host and travels out the internal network will traverse a number of switches.
Switches have two key points of evidence that should be addressed by incident
responders. First is the content addressable memory (CAM) table. This CAM
table maps the physical ports on the switch to the Network Interface Card (NIC)
on each device connected to the switch. Incident responders in tracing
connections to specific network jacks can utilize this information. This can aid in
the identification of possible rogue devices. The second way switches can aid in
an incident investigation is through facilitating network traffic capture.
Routers: Routers allow organizations to connect multiple LANs into either
Metropolitan Area Networks (MAN) or Wide Area Networks (WAN). As a
result, they handle an extensive amount of traffic. The key piece of evidentiary
information that routers contain is the routing table. This table holds the
information for specific physical ports that map to the networks. Routers can also
be configured to deny specific traffic between networks and maintain logs on
allowed traffic and data flow.
Firewalls: Firewalls have changed significantly since the days when they were
considered just a different type of router. Next-generation firewalls contain a
wide variety of features such as intrusion detection and prevention, web filtering,
data loss prevention, and detailed logs about allowed and denied traffic.
Firewalls oftentimes serve as the detection mechanism that alerts security
personnel to potential incidents. Incident responders should have as much
visibility into how their organization's firewalls function and what data can be
obtained prior to an incident.

[ 58 ]
Network Evidence Collection

Network intrusion detection and prevention systems: These systems were

purposefully designed to provide security personnel and incident responders
with information concerning potential malicious activity on the network
infrastructure. These systems utilize a combination of network monitoring and
rulesets to determine whether there is malicious activity. Intrusion Detection
Systems (IDSes) are often configured to alert to specific malicious activity while
Intrusion Prevention Systems (IPSes) can detect, but also block potential
malicious activity. In either case, both types of platform's logs are an excellent
place for incident responders to locate specific evidence on malicious activity.
Web proxy servers: Organization often utilize web proxy servers to control how
users interact with websites and other internet-based resources. As a result, these
devices can give an enterprise-wide picture of web traffic that both originates and
is destined for internal hosts. Web proxies also have the additional feature set of
alerting to connections to known malware C2 servers or websites that serve up
malware. A review of web proxy logs in conjunction with a possible
compromised host may identify a source of malicious traffic or a C2 server
exerting control over the host.
Domain controllers or authentication servers: Serving the entire network
domain, authentication servers are the primary location that incident responders
can leverage for details on successful or unsuccessful logins, credentials
manipulation, or other credentials use.
DHCP server: Maintaining a list of assigned IP addresses to workstations or
laptops within the organization requires an inordinate amount of upkeep. The
use of Dynamic Host Configuration Protocol (DHCP) allows for the dynamic
assignment of IP addresses to systems on the LAN. The DHCP servers often
contain logs on the assignment of IP addresses mapped to the MAC address of
the host's NIC. This becomes important if an incident responder has to track
down a specific workstation or laptop that was connected to the network at a
specific data and time.
Application servers: A wide range of applications from email to web applications
is housed on network servers. Each of these can provide logs specific to the type
are application.

Network devices such as switches, routers, and firewalls also have their own internal logs
that maintain data on access and changes. Incident responders should become familiar with
the types of network devices on their organization's network and also be able to access
these logs in the event of an incident.

[ 59 ]
Network Evidence Collection

A variety of sources from security controls to SQL databases are configured to send logs to
the SIEM. In this case, the SQL database located at [Link] indicates that the user
account USSalesSyncAcct was utilized to copy a database to the remote host located at
[Link]. The SIEM allows for quick examination of this type of activity. For example, if
it is determined that the account USSalesSyncAcct had been compromised, CSIRT analysts
can quickly query the SIEM for any usage of that account. From there, they would be able to
see the log entry that indicated a copy of a database to the remote host. Without that SIEM,
CSIRT analysts would have to search each individual system that might have been
accessed, a process that may be prohibitive.

From the SIEM platform, security and network analysts have the ability to perform a
number of different tasks related to incident response:

Log aggregation:Typical enterprises have several thousand devices within the

internal network, each with their own logs; the SIEM can be deployed to
aggregate these logs in a central location.
Log retention:Another key feature that SIEM platforms provide is a platform to
retain logs. Compliance frameworks such as the Payment Card Industry Data
Security Standard (PCI-DSS) stipulate that logs should be maintained for a
period of 1 year with 90 days immediately available. SIEM platforms can aid with
log management by providing a system that archives logs in an orderly fashion
and allows for the immediate retrieval.
Routine analysis: It is advisable with a SIEM platform to conduct period reviews
of the information. SIEM platforms often provide a dashboard that highlights key
elements such as the number of connections, data flow, and any critical alerts.
SIEMs also allow for reporting so that stakeholders can keep informed of activity.
Alerting: SIEM platforms have the ability to alert to specific conditions that may
indicate malicious activity. This can include alerting from security controls such
as anti-virus, intrusion prevention, or detection systems. Another key feature of
SIEM platforms is event correlation. This technique examines the log files and
determines whether there is a link or any commonality in the events. The SIEM
then has the capability to alert on these types of events. For example, if a user
account attempts multiple logins across a number of systems in the enterprise,
the SIEM can identify that activity and alert to it.

[ 61 ]