Incident Response and Computer Forensics, Second Edition [Paperback]

Chris Prosise (Author), Kevin Mandia (Author), Matt Pepe (Author)

Book Description

Publication Date: July 17, 2003 | ISBN-10: 007222696X | ISBN-13: 978-0072226966 | Edition: 2

Written by FBI insiders, this updated best-seller offers a look at the legal, procedural, and technical steps of incident response and computer forensics. Including new chapters on forensic analysis and remediation, and real-world case studies, this revealing book shows how to counteract and conquer today’s hack attacks.

Editorial Reviews

Amazon.com Review

A strong system of defenses will save your systems from falling victim to published and otherwise uninventive attacks, but even the most heavily defended system can be cracked under the right conditions. Incident Response aims to teach you how to determine when an attack has occurred or is underway--they're often hard to spot--and show you what to do about it. Authors Kevin Mandia and Chris Prosise favor a tools- and procedures-centric approach to the subject, thereby distinguishing this book from others that catalog particular attacks and methods for dealing with each one. The approach is more generic, and therefore better suited to dealing with newly emerging attack techniques.

Anti-attack procedures are presented with the goal of identifying, apprehending, and successfully prosecuting attackers. The advice on carefully preserving volatile information, such as the list of processes active at the time of an attack, is easy to follow. The book is quick to endorse tools, the functionalities of which are described so as to inspire creative applications. Information on bad-guy behavior is top quality as well, giving readers knowledge of how to interpret logs and other observed phenomena. Mandia and Prosise don't--and can't--offer a foolproof guide to catching crackers in the act, but they do offer a great "best practices" guide to active surveillance. --David Wall

Topics covered: Monitoring computer systems for evidence of malicious activity, and reacting to such activity when it's detected. With coverage of Windows and Unix systems as well as non-platform-specific resources like Web services and routers, the book covers the fundamentals of incident response, processes for gathering evidence of an attack, and tools for making forensic work easier. --This text refers to an out of print or unavailable edition of this title.

Review

"... poorly trained network administrators and the lack of firewalls and intrustion detection systems still make it difficult to find the source and strategy of the attack." Computerworld article (8/21/00) on Incident Response featuring David Dittrich, a researcher who spoke at the Usenix Security Symposium." --This text refers to an out of print or unavailable edition of this title.

See all Editorial Reviews

Product Details

• Paperback: 507 pages
• Publisher: McGraw-Hill/Osborne; 2 edition (July 17, 2003)
• Language: English
• ISBN-10: 007222696X
• ISBN-13: 978-0072226966
• Product Dimensions: 9.2 x 7.4 x 1.1 inches
• Shipping Weight: 2 pounds (View shipping rates and policies)
• Average Customer Review: 4.5 out of 5 stars  See all reviews (31 customer reviews)
• Amazon Best Sellers Rank: #365,146 in Books (See Top 100 in Books)

Customer Reviews

Most Helpful Customer Reviews

34 of 36 people found the following review helpful:

5.0 out of 5 stars Ground-breaking, timely, engaging, authoritative, August 15, 2001

By 

Richard Bejtlich "TaoSecurity" (Metro Washington, DC) - See all my reviews
(REAL NAME)   

This review is from: Incident Response: Investigating Computer Crime (Paperback)

I am a senior engineer for network security operations. I am a graduate of the flagship session of the System Administration, Networking, and Security institute's Forensics, Investigations, and Response Education (SANS FIRE) program. "Incident Response" (IR) should have been the textbook for that program. It is the most definitive work I've read on incident response and computer forensics. I highly recommend every security professional take advantage of this book.

IR starts with a revealing case study, and follows through with additional mini-studies and "eye witness reports" based on the authors' experiences. It provides plenty of clear diagrams and charts to reinforce key points, like the innovative "hard drive layers" outlined in chapter five. Most every mention of a command line program is followed by an example of that command in action, either via screenshot or text sample. These examples let readers try similar commands on their own workstations, reinforcing the authors' investigative directions.

Beyond the excellent presentation of technical material, IR frames its discussion of incident response and computer forensics in a practical investigative methodology. My SANS FIRE training repeatedly stressed the importance of documentation, policies, processes, and methodology when performing forensic work worthy of adversarial legal scrutiny. IR's attention to detail helps investigators collect evidence in a professional, repeatable, forensically sound manner.

Having appeared in court to defend their investigations, the authors share their knowledge and emphasize crucial steps to avoid forensic pitfalls. (An example is a DOS boot floppy's interaction with the DRVSPACE.BIN file. IR explains how to avoid this issue in detail.) Falling victim to these pitfalls could give a defense attorney an easy way to clear his client, or at least make certain evidence questionable in court.

The book is not perfect. Several typos indicated somewhat rushed publication, but did not detract from technical accuracy. I would have liked more material in chapter five on file systems; perhaps another appendix would be useful?

Many books and papers describe incident response procedures for UNIX, but few dare to discuss Windows. Given the predominance of compromised Windows hosts, this book thankfully addresses the Windows response task in a complete and clear manner. In many cases UNIX and Windows are compared side-by-side, and commands for one OS are explained using equivalents for the other OS.

IR provides a durable blend of practical investigative techniques and technical insights. I predict that investigators will cite the procedures in this book as examples of "best practices" when they defend their actions in court. I plan to build my company's incident response capability around IR's recommendations.

(Disclaimer: I received my review copy free from Foundstone.)

17 of 18 people found the following review helpful:

5.0 out of 5 stars The best computer forensics book just got better, October 15, 2003

By 

Richard Bejtlich "TaoSecurity" (Metro Washington, DC) - See all my reviews
(REAL NAME)   

This review is from: Incident Response and Computer Forensics, Second Edition (Paperback)

First, full disclosure: the publisher sent me a free review copy, I used to work for Mandia and now work with Prosise and Pepe, and I contributed material incorporated into chapters 8 and 14. I still think "Incident Response and Computer Forensics, 2nd Edition" (IRCF2E) is the best forensics book on the market. Notice I said "forensics." It's significant that the first edition's title was "Incident Response: Investigating Computer Crime." While IRCF2E contains plenty of IR material, I sense a shift away from computer security and towards the legal world in this second edition.

Readers of the first edition will want to know what's new. While reading IRCF2E I thumbed through the first edition and make some notes. The following chapters appear mostly or totally new: 1 (Real-World Incidents), 3 (Preparing for Incident Response), 4 (After Detection of an Incident), 9 (Evidence Handling), 10 (Computer System Storage Fundamentals), 11 (Data Analysis Techniques), 17 (Writing Computer Forensics Reports). Some chapters contain rewrites or new material: 2 (Intro to the IR Process), 5 (Live Data Collection from Windows), 6 (Live Data Collection from UNIX), 7 (Forensic Duplication), 8 (Collecting Network-based Evidence), and 14 (Analyzing Network Traffic). The remainder received minor rewrites. Some chapters from the first edition on IIS and application forensics were integrated elsewhere.

The most informative sections for me, as a reader of both editions, appear in chapters 7, 10, and 17. Chapter 7 lays down the law on differences between a "forensic duplication," a "qualified forensic duplication," and a "mirror image." Expert witnesses can turn to IRCF2E as a standard when testifying, thanks to this chapter's clarity and citations of "Daubert" and "Kumho." Chapter 10 nicely explains file systems and storage layers. Chapter 17 gives desperately needed guidance on writing forensics reports -- the part of an engagement the client really wants.

I found a few errata items, such as p. 61's reference to the PPA; it should be "Privacy Protection Act." On pp. 97-98, all of the "ps" tools should list the Sysinternals home page, not Foundstone. Despite my contribution of material to the network-oriented chapters of IRCF2E, don't believe that I advocate using laptops for monitoring duties (p. 179). Laptops and especially their NIC drivers are not built for packet capture in high speed environments.

IRCF2E is one of the few books in print where the word "forensics" deserves to be on the cover. Many prominent "forensics" titles deliver nothing useful to practitioners. As was the case with the first edition, investigators can use IRCF2E in operational environments to do real work. This book lays much of the groundwork for doing cases. Watch for "Real Digital Forensics" to be published next year, which walks readers through case-based evidence to teach how to collect, interpret, and analyze host- and network-based evidence.

20 of 22 people found the following review helpful:

5.0 out of 5 stars Another good product from the Foundstone people, June 26, 2001

By A Customer

This review is from: Incident Response: Investigating Computer Crime (Paperback)

I got an advanced copy of this book and I must say that it was not dissappointing. After reading hacking exposed, I expected usefull material from the Foundstone people and they have really come through with this book. There aren't that many good IR books out there. This has set a good standard.

Like the Hacking Exposed book, you need to sit down at a computer when reading IR. With any technical book, the real values comes with using the tools and techniques that the book describes at the computer and learning the ins and outs.

I wonder if they have the second addition already in the works?