Task 2

-

 Interview with IT manager: 

  1. When exactly was the incident first detected (date and time UTC or local) and who triggered the alert. 

What to capture: exact timestamp, alert source (user, automated alert, backup failure). 

  1. What was the first visible symptom (deleted files, ransom note, service outage) and the sequence of events from detection to now. 

What to capture: order of events and how long each took. 

  1. Which specific folders, filenames or client IDs were deleted or altered on the NAS and how many client records (approximate count) contained PII. 

What to capture: exact folder names, file names, client identifiers. 

  1. Do we have evidence of data exfiltration prior to deletion (suspicious outbound transfers, large uploads, or unknown external connections around the same time)? 

What to capture: timestamps, transfer sizes, destination IPs or domains. 

  1. Describe the backup configuration for the NAS (onsite/offsite, frequency, last successful backup timestamp) and when the last successful restore test was performed. 

What to capture: backup timestamps, retention windows, backup system name. 

  1. Are backups currently intact and isolated from the network? If not, what problems were identified when attempting verification? 

What to capture: verification outcome and any errors. 

  1. Which user accounts performed the delete operations according to NAS logs (usernames, service accounts, or IP-based sessions)? 

What to capture: usernames, associated device names, session timestamps. 

  1. Which administrator or shared accounts currently exist on the NAS and when were they last used? 

  1. Who can create admin accounts and what is the approval process? 

What to capture: list of admin/shared accounts and owner/approver names. 

  1. What do the firewall logs show for the incident window (external source IPs, ports, protocols, repeated authentication attempts)?  

  1. Have we blocked any of those IPs yet? 

What to capture: external IPs, ports, times, and actions taken. 

  1. How is remote access currently authenticated (VPN vendor, MFA, device compliance checks, MDM).  

  1. Were any non-corporate devices used to connect at the incident times? 

What to capture: MFA status, MDM presence, device identifiers. 

  1. Which logs have been secured and where are the forensic images/log exports stored?  

  1. Following on, who has exclusive access? 

What to capture: list of preserved logs, storage location, hash or export confirmation. 

  1. What immediate remediation steps have already been performed (account disables, firewall blocks, NAS taken offline, forensic engagement)?  

 

  1. Following on the previous question, what remains outstanding and who is accountable? 

What to capture: actions taken, outstanding actions, responsible people and timelines. 

 

Comments

Post a Comment

Popular posts from this blog

OS A3 Task 1

-
    Threat   Vulnerability   Asset   Impact   Likelihood   Risk   Action   Control Type   Gate is left unlocked for the purpose of  convenience   This allows intruders to access the building with ease   Physical  data  stored  on premises                  Confidential data could be accessed by the attackers  and  stolen           Medium   Gates are always left unlocked for convenience and  visitors           High   Data is exfiltrated from the company with potential  to damage company reputation, breach of GDPR with financial implications and potential for customers  becoming victims of identity theft     High   Provide users with passcodes to enter the  building and  implement a security system at the gate to  identify  and authorise access buil...
Read more

OS A3 Task 2

-
Task 2   Introduction   As a new , up-and-coming,  growing organisation,  Linkchain  Gaming must ensure that its information security policy is tailored to  its  requirements and aligned with regulatory standards. A modern s ecurity compliance with laws and regulations. This report will outline recommended user and  administrative  controls for an updated security policy. These controls aim to protect sensitive data ,  and recommendat ions are supported by recognised frameworks.   User Controls    Network and Wi-Fi Access:   Threats Addressed:  Network passphrase on noticeboard, visitors on same network   To  protect the network, it is important to remove the passphrase from the noticeboard and change it. It is recommended  to create a segmented network with a   separate  guest passphrase for  visitors,  so they are completely isolated from internal systems and the file server. ...
Read more