Thulshani Samaraveera
28755
Case Study: Data Breach at XYZ Corporation – Digital Forensic Investigation
Report
Task 1: Understanding the Cyber Attack
1. Possible Type of Attack:
The cyber attack on XYZ Corporation could be one or more of the
following:
• Advanced Persistent Threat (APT): A long-term, sophisticated attack
where an attacker gains unauthorized access and remains undetected for an
extended period.
• Phishing: The attackers might have used phishing emails to trick employees
into downloading malware or clicking on links with malware.
• Malware Attack (Trojan, Ransomware, or Keylogger): A Trojan or keylogger
might have been installed to steal credentials, leading to data exfiltration.
• Zero-Day Exploit: Attackers could have exploited an unknown vulnerability in
XYZ's systems to gain unauthorized access.
2. Execution of the Attack:
•Initial access might have been achieved by the attacker through a phishing
email that contained a malicious link or attachment.
•Once inside, they may have installed malware, for example, a keylogger or
remote access Trojan (RAT), to ensure persistence.
•Privilege escalation and lateral movement within the network were likely
performed by the attacker.
•They exfiltrated sensitive client information through unauthorized file transfers
that were seen in system logs.
3.Immediate Containment Steps:
• Isolate Affected Systems: Disconnect infected systems from the network to
prevent further propagation.
• Block Malicious IPs and Accounts: Disable infected user accounts and block
suspicious IP addresses.
• Patch Vulnerabilities: Apply security patches and updates to close down any
exploited vulnerabilities.
• Monitor Network Traffic: Increase logging and network monitoring to detect
further anomalies.
• Initiate Incident Response: Engage the incident response team and follow the
defined incident handling procedures.
Task 2: Digital Forensics Investigation Process
1. Primary Steps in Digital Forensics Investigation (ACPO Guidelines):
* Preserve Evidence: Protect data integrity by making forensic images of
affected systems.
* Acquire Data: Collect logs, memory dumps, and disk images using
forensically sound methods.
* Analyze Data: Examine file systems, network logs, and malware artifacts
for indicators of attack.
* Document Findings: Maintain detailed records of the investigation, tools,
and findings.
* Present Evidence: Prepare findings for legal or internal review while
maintaining chain of custody.
2. Importance of Chain of Custody:
• Prevents tampering with evidence and makes it admissible in court.
• Documents who accessed the evidence, when, and why.
• Maintains credibility and integrity throughout the investigation process.
3. Computer Forensic Tools:
• Autopsy/Sleuth Kit: Analysis of file systems and recovery of deleted files.
• Wireshark: Capturing and analysis of network traffic to identify suspicious
communication.
• Volatility: Memory forensics tool for RAM dump analysis for malware and
process activity.
Task 3: Malware Analysis & Prevention (20 Marks)
1. Malware's Role in the Breach:
* The attacker could have used a remote access Trojan or a keylogger for
stealing credentials.
* Ransomware could have been employed to encrypt the data and demand
payment.
* Worms could have spread through the network infecting multiple devices.
2. Applying Hashing Techniques for Integrity Checking:
* MD5, SHA-1, or SHA-3 can generate a unique fingerprint for files.
* Helps check if digital evidence has been altered during the course of
investigation.
• Preserves forensic copies of the data intact.
3. Anti-Forensic Techniques & Countermeasures:
• Data Obfuscation: Attackers may encrypt or compress files to evade detection.
• Countermeasure: Use decryption tools and entropy analysis to detect
suspicious files.
• Log Manipulation: Attackers may delete or modify system logs.
• Countermeasure: Use forensic log recovery techniques and SIEM (Security
Information and Event Management) tools to detect tampering.
Task 4: Cybersecurity Protection Measures
1. Countermeasures for Future Prevention:
• Deploy Multi-Factor Authentication (MFA): Removes credential theft risk.
• Frequent Security Audits & Penetration Testing: Reveals and remediates
vulnerabilities before attackers can exploit them.
• Network Segmentation: Limits attacker lateral movement and reduces
damage in case of a breach.
2. Security Policies & Governance Importance:
• Establishes clear direction on cybersecurity best practices.
• Establishes incident response procedures to ensure quick action in case of
an attack.
• Ensures compliance with regulatory requirements such as GDPR or PCI-
DSS.
3. Minimal Incident Response Plan:
• Preparation: Train staff, set up monitoring, and set up response procedures.
• Detection & Analysis: Detect security incidents through logs, alerts, and
anomaly detection.
• Containment: Isolate affected systems to prevent further damage.
• Eradication: Remove malware, close vulnerabilities, and rebuild systems.
• Recovery: Confirm system integrity and restore operations safely.
• Lessons Learned: Conduct a post-incident review to improve future responses.
