Chapter 11. IoT Incident Response and Forensic Analysis

Incident management is an enormous topic, and many excellent and thorough volumes have been written about its utility and execution in the traditional IT enterprise.

At its core, incident management is a life cycle-driven set of activities that range from planning, detection, containment, eradication, and recovery, to the final learning process about what went wrong and how to improve your security posture to prevent similar future incidents.

This chapter provides guidance for organizations—corporate or otherwise—that plan to integrate IoT systems into their enterprises, and that need to develop or update their incident response plans to suit.

Incident management for IoT systems follows the same frameworks that are already familiar to us. There are simply new considerations and questions to answer when trying to plan effective responses to compromised IoT-related systems.

To distinguish the IoT from conventional IT, consider the following...

Threats to both safety and security

Ideally, misuse cases will be created during the upfront threat modeling process. Many specific misuse patterns can then be generated for each misuse case. Misuse patterns should be low-level enough that they can be decomposed into signature sets applicable to the monitoring technology (for example, IDS/IPS, SIEM, and so on) that will be used both on-premises and in your cloud environment.

Patterns can include device patterns, network patterns, service performance, and just about anything that indicates potential misuse, malfunction, or outright compromise, as follows:

In many IoT use cases, SIEMs can be telemetry-enhanced. We say telemetry-enhanced SIEMs, because physically interacting IoT devices have many additional properties that may be monitorable and important for detecting misbehavior or misuse. Temperature, time of day, status and performance of actuators, event correlation with other neighboring IoT device states: almost any kind of available data...

Defining, planning, and executing an IoT incident response

IoT incident response and management can be broken down into four phases:

• Planning
• Detection and analysis
• Containment, eradication, and recovery
• Post-incident activity

 

 

 

The following diagram provides a view into the processes and how they relate to one another:

Any organization should have, at a minimum, these processes well documented and tailored for its unique system(s), technologies, and deployment approaches.

Incident response planning

Planning (sometimes called incident response preparation) is composed of those activities that are, figuratively speaking, designed to keep you from behaving like a deer in headlights when disaster strikes. If your company were to experience a massive denial of service attack that your hosting provider's load balancers and gateway couldn't keep up with, do you know what would happen, and how you would respond ? Does your cloud provider handle this automatically, or are you expected to intervene by escalating...

Detection and analysis

Today's Security Information and Event Management (SIEM) systems are powerful tools that allow correlation between any type of observable event to flag possible incidents. These same systems can of course be configured to monitor the infrastructure that supports IoT devices; however, there are considerations that will affect the ability to maintain a sufficient degree of situational awareness across a deployed IoT system:

• IoT systems are heavily dependent on cloud-hosted infrastructures or edge gateway systems
• IoT systems may include highly constrained (that is, limited processing, storage, or communication ability) devices that often lack the ability to capture and forward event logs

These considerations drive a need to architect the monitoring infrastructure to capture instrumentation data from CSPs that support the system, as well as anything that is possible from the devices themselves.

Although there are limited options available in this regard, some small start-up...

IoT forensics

This section provides a more detailed treatment of IoT forensics, a crucial element of post-incident analysis activities. Forensics in the IoT poses a variety of unique challenges, but ubiquitous spread of IoT devices also introduces new forensics opportunities.

We will therefore discuss two facets of IoT forensics:

• Forensics of an IoT device that may been compromised (as part of an incident)
• Forensics in which the IoT devices are ancillary to the event, but useful in resolving questions surrounding it

Post-incident device forensics

As part of an investigation process, system-level investigation may lead you to one or more devices (for example, sensor, actuator, gateway, or other server), and therefore a thorough forensic examination of the compromised device is in order to try to determine the characteristics of the attacker.

You may find specific files loaded or modified by the attacker, or in some cases it may be possible to lift fingerprints from the device itself. Device analysis...

Summary

This chapter provided guidance on building, maintaining, and executing an incident response plan, including the challenges and methods of IoT forensics. We defined IoT incident response and management and discussed the unique details related to executing IoT incident response activities.

Furthermore, this chapter established analytical aspects of IoT devices, as well as usage of IoT data in forensic activities.

The safe and secure implementation of IoT systems is a difficult challenge to undertake, given the unique characteristics of these systems, their ability to impact events in the physical world, and the diverse nature of IoT implementations. This book has attempted to provide practical advice for designing and deploying many types of complex IoT systems.

We hope that you are able to tailor this guidance to your own unique environments, even as the pace of change in this high-potential technology area continues to increase.