+IR-04(12) Malicious Code and Forensic Analysis
|
IR-04(12) Malicious Code and Forensic Analysis
Control
Analyze malicious code and/or other residual artifacts remaining in the system after the incident.
Discussion
When conducted carefully in an isolated environment, analysis of malicious code and other residual artifacts of a security incident or breach can give the organization insight into adversary tactics, techniques, and procedures. It can also indicate the identity or some defining characteristics of the adversary. In addition, malicious code analysis can help the organization develop responses to future incidents.
Assessment Objective
- malicious code remaining in the system is analyzed after the incident;
- other residual artifacts remaining in the system (if any) are analyzed after the incident.
Assessment Method
Examine
Incident response policy
procedures addressing incident handling
procedures addressing code and forensic analysis
procedures addressing incident response
incident response plan
system design documentation
malicious code protection mechanisms, tools, and techniques
results from malicious code analyses
system security plan
system audit records
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel with responsibility for malicious code protection
organizational personnel responsible for incident response/management
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|