Druva Logo

The Recovery Orange Book

Incident Response Team

Team Formation

Effective ransomware incident response requires clear delineation of roles and responsibilities. While smaller organizations may consolidate these functions or outsource some to third parties, defining a comprehensive scope for each role is crucial for a well-coordinated response. For smaller organizations, it's particularly important to identify who will assume each role, even if individuals wear multiple hats. Incident Response (IR) Team Roles and Responsibilities:

  • IR Lead (Commander): Leads the overall incident response, setting priorities, making critical decisions, and managing communication with all stakeholders. Activates the crisis management team, defines the response strategy, and oversees execution from detection to resolution.
    • Crisis Management
    • Team Coordination
    • Executive Communication and Notification
  • SOC Lead / Detection: Responsible for initial triage of (externally or internally reported) event information, security alerts, scoping the attack, mapping activity to MITRE ATT&CK, and building a detailed timeline. Monitors security systems in real-time, catching anomalies and Indicators of Compromise (IoCs) for early detection.
    • Real-time monitoring
    • Initial Investigation
  • Endpoint Lead: Handles critical actions at the endpoint level, including host isolation, termination of malicious processes, and remote triage of compromised systems.
  • Identity Lead: Disables or resets compromised accounts, implements MFA/sign-on policy changes, and revokes suspicious tokens/sessions across identity platforms.
  • Backup/Recovery Lead: Ensures integrity of backup snapshots, performs WORM checks for data immutability, and orchestrates critical restore workflows.
  • Cloud Ops: For cloud environments, responsible for key rotation, enforcing policy lockdowns, triaging flow logs and CloudTrail events, and managing cloud snapshots.
  • Forensics (Forensic Analyst): Meticulously collects evidence, maintains a strict chain of custody, performs imaging and memory capture, and secures artifacts for analysis. Dissects incidents, uncovering cause and scope, reconstructing attack timelines, and determining attacker operations.
    • Root Cause Analysis
    • Sample Analysis
    • Log Analysis
    • Evidence Collection
  • Comms/PR + Legal/Privacy: Manages all external communications, including preparing templates, drafting notices for regulators/customers, and ensuring compliance with legal/privacy regulations, maintaining attorney-client privilege. Where appropriate in support of GDPR, organizations should designate a Data Privacy Officer and keep that person informed of all current status reports.
  • Executive Sponsor: Provides high-level oversight, accepts residual risks, makes critical business tradeoffs, and serves as the primary interface with regulators and the board. This is most often the CISO, but can also represent the CIO or CTO, or whomever helps with the constructions of incident response plans, tests, and ongoing documentation of assurance.
  • IT Service Management: Can be initial notification hub by customers or employees, along with help desks. Facilitates operational aspects, including initiating emergency CAB meetings, managing change windows, updating status pages, and providing help desk macros. Safeguards servers and systems, manages backups, and enforces security configurations.
    • Patch Management
    • Security Configuration
    • Backup Procedures
  • Threat Intelligence Analyst: Researches ransomware groups and their TTPs, transforming intelligence into actionable insights for defense and response strategies.
    • Analysis of IoCs
    • Collaborate with security analysts to map IoCs to ransomware groups and families.
  • Network Engineer: Secures and maintains network infrastructure. Isolates affected systems, monitors network traffic, and adjusts configurations to contain threats.
    • Network Segmentation
    • Traffic Monitoring
    • Access Controls
  • Internal IR Coordinator: Acts as a bridge across executive, technical, business, legal, and communication teams for smooth collaboration during incident response.
    • Cross Functional Coordination
    • Incident Flow Management

Internal Team & External Stakeholder Contacts

A single hotline/alias should be established and communicated to all employees to page on-call personnel and open a bridge within five minutes of an incident being declared. This system should be tested monthly to ensure its reliability, using various business groups within your organization. This can include but is not limited to helpdesk personnel, marketing, sales, engineering, and executive team kickoffs.

An external panel of pre-approved contacts is also critical. This typically includes an incident response retainer firm, a cyber insurer breach coach, law enforcement points of contact (LE POC), and vendor Technical Account Managers (TAMs) from key security providers such as CrowdStrike, Okta, Druva, and cloud IaaS or SaaS providers.

Configuration Hardening

  • Okta: create IR-Admins group with phishing-resistant MFA (WebAuthn); sign-on policy denies legacy IMAP/POP, enforces step-up for admin consoles, and checks device posture; Okta Workflows for Deactivate User + Revoke Sessions one-click.
  • CrowdStrike: set Prevention Policy Aggressive on servers; enable Contain on High/Critical; stage Real Time Response (RTR) scripts to collect autoruns, services, netstat, and copy recent binaries to a case path.
  • Splunk: “IR master” app with saved searches and risk-based alerting. Examples used during triage:
    • Shadow copy deletion

      index=wineventlog EventCode=4688
      CommandLine="*vssadmin*delete*shadows*"
      | stats count by host,user,CommandLine

    • Mass file renames (encryption proxy):

      index=fs_* action=rename
      | stats count by src_host
      | where count>1000

Evidence Collection Process & Location: A Comprehensive Guide

Effective incident response and thorough post-incident analyses hinge upon meticulously executed evidence collection processes. This section details the critical considerations and practical examples for gathering, storing, and preserving digital evidence, ensuring its integrity and admissibility for future investigations.

Core Principles of Evidence Collection:

What to Collect: The initial step involves a comprehensive identification of all data types that could offer critical insights into an attack. This extends beyond obvious system artifacts to include network logs, communication records, and any other digital footprint left by the attacker. A proactive approach to understanding potential evidence sources is crucial for a complete collection.

How to Collect: The methodology employed for data collection is paramount. It requires the use of standardized, forensically sound methods to guarantee the integrity, authenticity, and admissibility of the collected data in legal or internal proceedings. This involves utilizing trusted, industry-recognized tools and meticulously maintaining a strict chain of custody for every piece of evidence. Documentation of the collection process, including timestamps, tools used, and personnel involved, is essential.

Where to Store (Immutable Vault): Once collected, evidence must be stored in secure, immutable locations. This critical step prevents any unauthorized tampering, alteration, or deletion of the collected evidence, thereby preserving its integrity and value. The designated storage solution should offer features that ensure data immutability, providing an unalterable record of the evidence.

Practical Examples of Evidence Collection, Methodologies, and Storage:

To illustrate these principles, let's explore concrete examples across various data types and environments:

What to Collect:

The scope of evidence can be extensive and includes, but is not limited to:

  • Endpoint Data:
    • EDR (Endpoint Detection and Response) Triage Zips: Compressed files containing critical endpoint data like process lists, network connections, loaded modules, and registry keys, offering a quick snapshot of system activity.
    • Disk Images (Full Forensic Images): Bit-for-bit copies of entire hard drives or partitions, preserving all data, including deleted files and unallocated space. These are crucial for in-depth forensic analysis.
    • Memory Captures (RAM Dumps): Snapshots of a system's volatile memory, which can contain active processes, network connections, encryption keys, and other data not written to disk.
    • Windows Event Logs (Security, System, Application): Detailed records of events occurring on a Windows system, providing insights into user logins, process execution, system errors, and security-related incidents.
  • Cloud & Infrastructure Logs:
    • CloudTrail/Azure Activity Logs: Comprehensive logs of actions taken by users, roles, or AWS/Azure services, crucial for understanding activities within cloud environments.
    • SIEM (Security Information and Event Management) Exports: Aggregated and correlated security events from various sources, providing a centralized view of security incidents and potential threats.
  • Attacker Artifacts & Communications:
    • Ransom Notes: Text files or images left by attackers detailing ransom demands, providing critical information about the threat actor and their intentions.
    • Exfiltration Indicators: Evidence of data being copied or transferred out of the organization's network, such as suspicious outbound network traffic or large file transfers.
    • Network Flow Data (NetFlow/IPFIX): Records of network conversations, including source/destination IP addresses, ports, and protocols, useful for identifying unusual network patterns.
    • Firewall Logs: Records of traffic allowed or denied by firewalls, indicating attempts to breach security controls or unusual communication patterns.
    • Proxy Logs: Records of web requests made through a proxy server, providing insights into user browsing habits and potential malicious websites accessed.
    • Email Logs: Records of email traffic, including sender, recipient, subject, and attachments, crucial for investigating phishing attempts or exfiltration via email.
    • Chat Logs (e.g., Teams, Slack, other instant messaging tools): Records of internal or external communications, which might contain attacker instructions, reconnaissance efforts, or internal discussions related to the incident.

How to Collect:

The methods employed for collection must prioritize forensic soundness and efficiency:

  • Automated Collection Scripts:
    • Standardized RTR (Real-Time Response)/KAPE (Kroll Artifact Parser and Extractor)/Velociraptor Scripts: Utilizing pre-defined and tested scripts for automated collection of common artifacts. These tools ensure consistency, reduce human error, and accelerate the collection process.
  • Time Synchronization:
    • Enterprise-wide NTP (Network Time Protocol): Ensuring all systems are synchronized to a common time source is critical for accurate timestamping of events, which is vital for reconstructing the timeline of an incident.
  • Evidence Integrity and Tracking:
    • Preserve Hashes and Handlers in the Incident Ticket: Calculating cryptographic hashes (e.g., MD5, SHA256) of collected files and documenting the individuals who handled the evidence. This provides a digital fingerprint for verification and maintains a clear chain of custody.
  • Volatile Data Collection:
    • Conduct Live Response for Volatile Data: For data that resides only in a system's active memory (e.g., running processes, open network connections, decryption keys), live response techniques are necessary to capture this fleeting information before it's lost during a system shutdown.
  • Disk Imaging Best Practices:
    • Utilize Forensic Workstations with Write-Blockers for Disk Imaging: Dedicated forensic workstations equipped with hardware write-blockers prevent any accidental writes to the source media during the imaging process, ensuring the integrity of the original evidence.

Where (Immutable Vault):

Secure and immutable storage is paramount for evidence preservation:

  • AWS (Amazon Web Services):
    • S3 bucket with Object Lock (Compliance mode) enabled for immutability: This feature prevents objects from being overwritten or deleted for a fixed amount of time or indefinitely, providing a strong guarantee of immutability.
    • A dedicated case folder per incident: Organizing evidence by incident within the S3 bucket facilitates efficient retrieval and management.
    • Bucket policy explicitly denies s3:DeleteObject* actions: Implementing granular access controls at the bucket level ensures that even privileged users cannot accidentally or maliciously delete evidence.
    • Replication to a dedicated, isolated IR (Incident Response) account for redundancy and security: Replicating data to a separate, highly restricted account provides an additional layer of security and redundancy, protecting against compromise of the primary account.
    • Server-side encryption enabled for data at rest: Encrypting data stored in S3 ensures confidentiality and protects against unauthorized access.
  • Azure:
    • Immutable Blob storage with time-based retention or legal hold for evidence preservation: Similar to AWS Object Lock, Azure's immutable blob storage offers policies that prevent data from being modified or deleted, with options for specific retention periods or indefinite legal holds.
    • A dedicated IR subscription with strict access controls: Isolating incident response resources within a dedicated subscription limits the blast radius of any potential compromise and allows for tighter security configurations.
    • Private endpoints to restrict network access: Configuring private endpoints ensures that the storage account is only accessible from within a private virtual network, significantly reducing exposure to the public internet.
    • RBAC (Role-Based Access Control) policies limited to forensics and authorized incident response personnel: Implementing least privilege access ensures that only authorized individuals with specific roles can access and manage the evidence vault.
  • On-Premises (not recommended):
    • Secure, air-gapped storage arrays with WORM (Write Once Read Many) capabilities: Air-gapped systems are physically isolated from the production network, providing a strong defense against network-based attacks. WORM capabilities ensure that once data is written, it cannot be altered or deleted.
    • Physical access controls to the storage environment: Restricting physical access to the storage infrastructure prevents unauthorized individuals from tampering with the hardware.
    • Encryption of data at rest: Encrypting data on the storage arrays protects against unauthorized access even if the physical storage is compromised.
    • Dedicated forensic servers for analysis, isolated from the production network: Performing analysis on dedicated, isolated servers prevents any potential compromise of the production environment from the forensic analysis process and ensures the integrity of the analysis tools.