Send a text

 Show Notes: Episode on Containment, Eradication, and Recovery

In this episode of Traffic Light Protocol,  Clint Marsden explores the containment, eradication, and recovery phases of the NIST SP 800-61 framework for computer security incident handling.

Key Topics Covered:

• Containment Strategies:  Choosing appropriate containment methods based on the incident type, potential damage, service availability, and evidence preservation. Examples include power disconnection and network isolation.
• Real-World Example: Clint shares an incident response case where premature action against attackers led to a total domain takeover.
• Evidence Gathering and Handling: The use of tools like write blockers to preserve evidence integrity.
• Threat Analysis: Highlights passive techniques for analysing threats without alerting attackers, such as remote log analysis and OPSEC to track attackers
• Restoration and Recovery: Covers steps to restore systems to normal operations, including vulnerability patching, backup restoration, and password resets.
• Future Considerations: Suggests engaging with external vendors for comprehensive incident response and utilizing threat intelligence platforms.

Join Clint Marsden as he guides you through the intricacies of incident response, helping you enhance your digital forensics skills. Follow Clint Marsden on LinkedIn (https://www.linkedin.com/in/clintmarsden/) and TLP on Linked In https://www.linkedin.com/company/traffic-light-protocol-the-digital-forensics-podcast-tlp for more updates and insights. 

Send a text

In this conclusion of the Detection phase, Clint wraps up Incident Prioritisation. This includes Functional impacts of the incident, information impact of the incident and the recoverability of the incident.

Not all of these are needed, or relevant when tracking your incident and Clint explains when to categorise incidents using these factors.

To finish off, Clint discusses incident notification - Who are the stakeholders that need to be informed and included in your incident response process, and how will they be notified?

Auscert: www.auscert.org.au

Send a text

In this 45 minute episode Clint covers a lot of ground based on the Detection phase of NIST 800-61.

Attack vectors for digital security incidents, including insider threats and weaponized USBs.
Cybersecurity incident response and detection, including NIST guidelines and Sysmon logging augmentation
The importance of following temporal linearity in  Forensic Investigations, expanding analysis to 5-10 minutes prior to and after events, particularly in Internet History and Memory Dumps
Building a baseline of activity through network pcaps and log analysis
Why synchronised clocks are important?
How detailed notes help in your investigations

Join the AI Cyber Security Skool Group
Inside the group, you’ll learn how to defend against prompt injections, lock down API keys, and stop your automations from turning into costly incidents. It’s a space for cyber pros, engineers, and AI builders to share playbooks, tools, and real-world lessons on keeping AI secure.
https://www.skool.com/ai-automation-security-5754/about?ref=3e3ebf81027c4bceb6f7cbfdbabe22ea

Send a text

In this Episode Clint Marsden talks about the first phase of Computer Security Incident Handling according to NIST. Listen to real world examples of how to get prepared before a Cyber Security Incident arrives.

Show notes:

Link to NIST SP 800-61 PDF

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf


Bro has been renamed to Zeek. https://zeek.org/

Rita is Real Intelligence Threat Analytics. Created by Active Countermeasures - 

Available from https://github.com/activecm/rita

Join the AI Cyber Security Skool Group
Inside the group, you’ll learn how to defend against prompt injections, lock down API keys, and stop your automations from turning into costly incidents. It’s a space for cyber pros, engineers, and AI builders to share playbooks, tools, and real-world lessons on keeping AI secure.
https://www.skool.com/ai-automation-security-5754/about?ref=3e3ebf81027c4bceb6f7cbfdbabe22ea

Send a text

In this first episode we kick off with Clint Marsden, the host of Traffic Light Protocol (TLP) where he talks about what its like to work in DFIR, how to get started with Cyber training, what to expect in future episodes, and of course a light touch on AI Forensics!

Join us for the first episode. The next episodes coming up talk about the NIST SP 800-61 where we break down Preparation, Detection, Eradication and Recovery.

Highlights:

Current trends and best practices in digital forensics, emphasizing the importance of preparation, experience across different domains, and the challenges of acquiring artifacts. Clint highlights the need for a wide breadth of experience and stressed the importance of continuous learning, while  emphasising the need for a broad range of tools and methods. 
Finally, we also discussed various methods for learning cybersecurity without spending money, including exploring free resources and leveraging AI.