Unix Systems Forensics and Incident Response Presented by Kristy Westphal kmwestphal@cox.net 1 *Why is IH/IR important? The keys to Incidence Response Plan for an incident Identify that an incident has occurred Containment of an incident Eradicate the issue Recovery Follow up 2 *Incident Severity How bad does it need to be to do all of this? Severity depends on Risk Assessment Performed by Security Dept., in conjunction with “assessment team” Lower severity will be logged Higher severity will warrant more investigation 3 *General Incident Handling Guidelines Keep a log Inform the right p

PLUG Linux Security HackFest ● ● ● LisaKachold@Obnosis.com “OSI Layer Up” Security Phoenix Linux Users Group Security Lab *Overview ● ● ● ● ● ● Review Linux OSI “Layer Up” Security Investigate Knoppix STD [A+] LiveCD Lab - Live Demos & Team Testing Questions & Interactive PLUG Lab Training Investigate Backtrack [WoW] LiveCD PLUG User Presented Forensic Challenges or Security Issues *Linux Security Goals ● ● ● ● ● ● ● ● ● ● TroubleShooting vs. “Ethical Hacking” For Professionals – Where to Draw the Line? Post Installation Security/Hardening Wireless/SSH Security in Public Nets Review TC

PLUG Linux Security HackFest ● ● ● LisaKachold@Obnosis.com “OSI Layer Up” Security Phoenix Linux Users Group Security Lab *Overview ● ● ● ● ● ● Review Linux OSI “Layer Up” Security Investigate Knoppix STD [A+] LiveCD Lab - Live Demos & Team Testing Questions & Interactive PLUG Lab Training Investigate Backtrack [WoW] LiveCD PLUG User Presented Forensic Challenges or Security Issues *Linux Security Goals ● ● ● ● ● ● ● ● ● ● TroubleShooting vs. “Ethical Hacking” For Professionals – Where to Draw the Line? Post Installation Security/Hardening Wireless/SSH Security in Public Nets Review TC