The network forensics process
Collection
The foundation for the network forensic process is collection. If collection is not trustworthy, none of the evidence is reliable. The following are key to the collection process:
- Secure the sensor
- Limit access to the sensor
- Position the sensor properly
- Verify the sensor collects traffic as expected
- Determine sensor failure modes
- Recognize and compensate for collection weaknesses
- Use trusted tools and techniques
- Document and automate the collection process
The sensor must absolutely not be compromised. Any hint of compromise undermines the reliability of the evidence and severely weakens the position of a forensic analyst serving as an expert witness. A compromised sensor demonstrates a lack of professional capability.
Only those with an explicit need to connect to the sensor should do so. Each person logging in to the sensor should employ their own username and password. If possible, replace password-based authentication with public/private keys (and strong passphrases) or use two-factor authentication with a hardware token. Direct login using the root account should be disabled. Only secure communications channels like SSH or SCP are acceptable ways to perform remote maintenance. Only those with a real need for root access should possess root access. Analysts who simply need to review network traffic can perform their duties with user-level privileges.
Be sure the sensor is located in the part of the network that sees the traffic of interest. Be prepared for opposing counsel to argue that "exculpatory activities were not seen by your sensor." For example, in the case of discovering inappropriate material on a computer, opposing counsel often argues that an intruder placed the offending content on the defendant's computer. Opposing counsel then argues that the network sensor didn't see the intruder's activity. Be prepared to show that the sensor would have captured that activity, had it actually occurred.
It is good to know that a sensor is working properly. It is better to understand the conditions which will cause that sensor to fail. When forensic investigators deploy packet collection devices, they need to know what could degrade or deny their systems. The condition most likely to harm packet collection is high bandwidth usage. Properly size the sensor and tune collection software to absolutely minimize dropped traffic.
Packet loss is only one difficulty to be expected when performing network forensics. Be prepared to deal with issues like lack of complete visibility, encrypted payloads, and limited sensor storage capacity. Visibility is a function of the network architecture, as defined by the routing protocols, switching design, and ingress and egress paths. Achieving completely pervasive network awareness may be too expensive or time-consuming, so investigators should assess and document ways their collection strategy could fail and implement countermeasures on the endpoint and elsewhere as appropriate.
Avoid tools that are not accepted by the general security community. Open source tools are frequently better suited for forensic roles as their code can be independently audited. When analyzing network traffic, be prepared to defend how you look at packets and why you make certain judgements. Relying on published sources (like solid books on network security monitoring) enables third parties to determine your adherence to industry best practices.
Whatever process you choose to follow, document it thoroughly. Justify why you take the steps you have selected and how they meet the criteria for a sound forensic workflow. Automate the process where possible to ensure reliability and repeatability. The ideal situation involves providing evidence to a neutral third party who follows your process and produces the same results, thanks to the reliability of your approach.
Preservation
Preserving network evidence is a requirement for network forensics that differs from normal security processes. Most incident detection and response work is "best effort." Network forensics may fail if opposing counsel can show that the evidence presented to a judge or jury is unreliable due to faulty preservation. Consider the following after collecting network evidence:
- Hash stored network traces and other data after collection and safely store the hashes elsewhere
- Understand the "forms of evidence"
- Copy evidence to read-only media when possible
- Create derivative evidence
- Follow chains of evidence
Hashing network traces and other data means using a hash function, such as SHA-256, to create a one-way cryptographic representation of the target data. Hashing provides a way to show that the original evidence is the same as any evidence reviewed at a later date. A change in a cryptographic hash shows that the underlying data has also changed, and is therefore potentially unreliable.
"Best evidence" is the original form of network based evidence (NBE) available to an investigator. If security analysts provide an investigator an attachment in an email as part of one case, that email and its attachment is the investigator’s best evidence. If security analysts provide an investigator a network trace in pcap format as part of another case, that file is the investigator's best evidence. In the case of network based forensics, network traffic saved on a sensor is the best evidence available.
Investigators should never, to the extent practically possible, directly work with the best evidence. The risk of corruption or other change is too great. Rather, investigators should make working copies of the best evidence, and scrutinize those duplications. Copies of any traffic transferred to a central storage location become working copies suitable for investigation.
Transferring large trace files from a remote site to a central location can occupy a large amount of bandwidth. In some cases it may be preferable to enlist the help staff co-located with the network sensor. Deploy the appliance with a Blu-Ray, DVD, or CD burner, and ask the person at the other end of the phone to help with the media creation process. The staffer can then ship the optical media via certified mail to the investigator's location. This process has the benefit of creating an archive of the best evidence. If two copies are made, then one copy can be safely stored while the second can be directly scrutinized by analysts. Any subsets of the data used by investigators to solve a case become "derivative evidence." Be sure to document the chain of custody for this evidence for every step in its lifecycle.
A chain of custody form should accompany any physical evidence and can be as simple as the following example:
