evidence collection in incident response

Question

In incident response, should evidence collection be done before incident containment or after?
If both, when evidence collection should be done before and when should it be done after (examples are welcomed)?
NB: For evidence collection, I'm thinking more specifically about memory imaging.

Answer 1

In an security incident response situation, incident containment should come before evidence preservation. To give you an example, imagine a hack at your company. You would want to limit the ability of the hacker to compromise your company's system any more than he already did.

Only after the incident has been contained, would evidence preservation come into play. It is extremely important to preserve the integrity of the evidence such as dates/times , user logins etc... when collecting relevant data.

Answer 2

This should be a given but as Anthony stated, you will want to contain the incident first and foremost. It wouldn't make much sense to try and collect evidence for a hack on a muti-million dollar company that trusts the security of it's information (client accounts, employee personal info, database files, etc) to you while an attacker was still free to do even more damage without any preventing measures being taken immediately.

Yes the incident needs to be contained first. Your job (if you work for a security firm) will likely depend upon that.

Answer 3

I agree with Anthony's and Yokai's answers.

However in some environments, you could isolate the affected host if its a minor incident, eg. Phishing in its early stage whereby there is no evidence of lateral movement etc.

In these scenarios, where the incident is believed to have not spread across the network, you could simply isolate it.

Next, depending on what how critical the affected asset is, you could do one of two things;

1) If the affected asset is not critical - if possible (and this is debatable) let the attack playout so as to dissect it after on to get intelligence if this was a targeted attack on your company infrastructure or a generic attack. However this also depends if you have a bigger Incident Response team to attend to looking out for anomalies on the rest of the network meanwhile and forensic specialists who will dissect the attack.

2) if the affected asset is critical - depending on what sort of attack it is.. eg Phishing, run AV scans on it, whilst revoking affected user's business email credentials etc. If it is ransomware and others, collect evidence and rollback the OS.

At the end, Incident Response is extremely dynamic, and it is all about quick decisions with your IR team, what sort of incident you are dealing, and the nature of the network environment.

cheers