Action for the future
Once any incident is over and done with, the team needs to focus on the lessons learned. From an incident response perspective, the focus is on answering questions such as the following:
How did this happen?
What can we do to prevent it from reoccurring?
What preventive measures can be put into place?
How can monitoring and alerting be improved?
From a network forensics perspective, the additional questions to be answered include the following:
Which artifacts exist that can help us identify such an incident in the future?
What are the lessons learned?
How can we improve the investigation process?
What IOC can be identified that can be shared with the Incident Response team to help prevent a reoccurrence of such an incident?
While the attackers constantly evolve and innovate in order to keep coming up with newer ways to compromise the networks without getting detected, network forensic investigators too have to keep pace. This means constantly updating oneself, learning from...
