Incident Response Report (4 pages APA Format)

Give a detail report for Malware Forensics during an Incident Response assessment.

Executive Summary (1 page minimum)

Include the purpose of the report, intended audience, and an explanation of the importance of risk assessment in cloud adoption

Summary of Findings (during a malware investigation) Include your determination of what occurred and when the incident occurred (1page minimum)

Recommendations (2pages minimum)

Include a discussion of ways the organization can improve security in light of Malware exploitation, access control, and security awareness culture. Include the role of security appliance such IDS and IPS (Intrusion Detection and Prevention Systems), Firewall, UTM Unified Threat Management), Encryption

 

"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"

*Include an in text reference.*

• In 1 sentence, identify an existential question with which you have grappled in relation to a client who has been traumatized.
  • Reflect on your fieldwork, or perhaps identify an existential question that might arise in working with the client in the case study you have selected throughout the course.
• In 3 to 4 brief sentences, describe where there is potential for growth for the client as a result of the trauma.
• In 3 to 4 brief sentences, explain where there is potential for growth for you, the social worker, as a result of listening to the client’s stories and bearing witness to their trauma.
• Describe any challenges you may experience between the meaning you hold based on your personal beliefs and working within the client’s potentially different belief framework.

 

"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"

 Include at least 250 words in your posting and at least 250 words in your reply.  Indicate at least one source or reference in your original post. Please see syllabus for details on submission requirements.Module 1 Discussion Question

Search “scholar.google.com” for a company, school, or person that has been the target of a network or system intrusion? What information was targeted? Was the attack successful? If so, what changes were made to ensure that this vulnerability was controlled? If not, what mechanisms were in-place to protect against the intrusion.

Reply-1(Shravan)

Introduction: Interruption location frameworks (IDSs) are programming or equipment frameworks that robotize the way toward observing the occasions happening in a PC framework or system, examining them for indications of security issues. As system assaults have expanded in number and seriousness in the course of recent years, interruption recognition frameworks have turned into an essential expansion to the security foundation of generally associations. This direction archive is planned as a preliminary in interruption recognition, created for the individuals who need to comprehend what security objectives interruption location components serve, how to choose and design interruption discovery frameworks for their particular framework and system situations, how to deal with the yield of interruption identification frameworks, and how to incorporate interruption recognition capacities with whatever remains of the authoritative security foundation. References to other data sources are likewise accommodated the peruse who requires particular or more point by point guidance on particular interruption identification issues.

In the most recent years there has been an expanding enthusiasm for the security of process control and SCADA frameworks. Moreover, ongoing PC assaults, for example, the Stunt worm, host appeared there are gatherings with the inspiration and assets to viably assault control frameworks.

While past work has proposed new security components for control frameworks, few of them have investigated new and in a general sense distinctive research issues for anchoring control frameworks when contrasted with anchoring conventional data innovation (IT) frameworks. Specifically, the complexity of new malware assaulting control frameworks – malware including zero-days assaults, rootkits made for control frameworks, and programming marked by confided in declaration specialists – has demonstrated that it is exceptionally hard to avert and identify these assaults dependent on IT framework data.

In this paper we demonstrate how, by joining information of the physical framework under control, we can distinguish PC assaults that change the conduct of the focused on control framework. By utilizing information of the physical framework we can center around the last goal of the assault, and not on the specific instruments of how vulnerabilities are misused, and how the assault is covered up. We break down the security and well being of our components by investigating the impacts of stealthy assaults, and by guaranteeing that programmed assault reaction instruments won’t drive the framework to a hazardous state.

Conclusion:

paper is to start the dialog among control and security experts – two regions that have had little cooperation previously. We trust that control specialists can use security building to outline – in light of a blend of their prescribed procedures – control calculations that go past wellbeing and adaptation to non-critical failure, and incorporate contemplations to survive focused on assaults.

Reference:

Natasha Gude , Teemu Koponen , Justin Pettit , Ben Pfaff , Martín Casado , Nick McKeown , Scott Shenker, NOX: towards an operating system for networks, ACM SIGCOMM Computer Communication Review, v.38 n.3, July 2008  [doi>10.1145/1384609.1384625]

reply-2(Santhosh)

Introduction:

The article (Breach, 2014) explains about the real-world scenarios where there was a network intrusion attack performed by cyber thieves and were successful in stealing financial and customer personal identification information from one of the largest retailer companies, “Target”. The intrusion was a major blow to the company’s security because of the loss of about 110 million user’s sensitive information. Intrusion Kill Chain Framework was used to detect and analyze the type of attack and other critical information. A malware was installed on Target’s point of sales system which transferred the information such as credit/debit cards to a European server. Target’s FireEye malware intrusion detection system sent alerts about the intrusion but negligence from the IT department has created this situation because they did not take any action.

Target’s network and system intrusion:

The malware that was installed on the target’s system has collected about 11 GB of stolen user critical information during target’s busy hours and transferred the data using FTP to Russian based server (Breach, 2014). The access to the Target’s system was gained by stealing credentials from an HVAC and refrigeration company, Fazio Mechanical Services which had a remote connection to the Target’s network. The Kill Chain (Breach, 2014) was used as a cybersecurity tool to detect intrusions related to the network and software. The kill chain system has proposed a solution to the traditional software installation. Traditional software installation assumes that the system is ready to detect and fight intrusion related to network and security. However, the improvised solution proposes that the intrusion detection systems should continuously monitor the logs on the server and other systems to verify if the access is legitimate, if not take immediate action.

Conclusion:

Target breach is one of the biggest security breaches in history. Security vulnerabilities increase with the advancement of the technology which makes the outdated intrusion detection systems to fail to protect from network and system intrusions. The tools like kill chain will help companies to keep the systems secure and locked down.

Reference:Breach, T. D. (2014). A “Kill Chain” Analysis of the 2013 Target Data Breach. 

 

"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"

 The program still runs, but it not in the correct way of the blackjack game. There is a problem while running it. When asking to hit more cards, it only allows to hit one time. The dealer points and play points equal then the game exists automatically without continuing play. Also, when players get bust, the dealer total points is the address not exactly the total points. Can anyone help me which it? I include my program and the question with it. It’s related to C program. Thanks for helping. 

• Attachment 1
• Attachment 2

 

"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"

/bin/bash/bin/bash[heap]/lib/x86_64-linux-gnu/libnss_files-2.19.so# Here is one/lib/x86_64-linux-gnu/libnss_files-2.19.so/lib/x86_64-linux-gnu/libnss_files-2.19.so/lib/x86_64-linux-gnu/libnss_nis-2.19.so# Here is another one/lib/x86_64-linux-gnu/libnss_nis-2.19.so# And another/lib/x86_64-linux-gnu/libnsl-2.19.so/lib/x86_64-linux-gnu/libnss_compat-2.19.so# And one more/lib/x86_64-l Finally, again print out the entire contents of /proc/self/maps, which should no longer contain any mappings with “—p” permissions.

For instance, here is a run of my reference implementation on linprog3:

% ./delete-mmaps ====== FILE /proc/self/maps ======/home/faculty/langley/test-read-maps/home/faculty/langley/test-read-maps/lib64/libc-2.20.so/lib64/libc-2.20.so/lib64/libc-2.20.so/lib64/libc-2.20.so 7f0b7e874000-7f0b7e878000 rw-p 00000000 00:00 0 /lib64/ld-2.20.so 7f0b7ea6e000-7f0b7ea71000 rw-p 00000000 00:00 0 7f0b7ea98000-7f0b7ea9a000 rw-p 00000000 00:00 0 /lib64/ld-2.20.so/lib64/ld-2.20.so 7f0b7ea9c000-7f0b7ea9d000 rw-p 00000000 00:00 0 [stack][vvar][vdso][vsyscall] Scanning /proc/self/maps to find mmaps with —p permissions… Found one at address start = 0x7f0b7e66e000, address end = 0x7f0b7e86e000, length = 2097152, permissions = —p Attempting to unmap(0x7f0b7e66e000,2097152)… And the return value was 0 ====== FILE /proc/self/maps ======/home/faculty/langley/test-read-maps/home/faculty/langley/test-read-maps[heap]/lib64/libc-2.20.so/lib64/libc-2.20.so/lib64/libc-2.20.so 7f0b7e874000-7f0b7e878000 rw-p 00000000 00:00 0 /lib64/ld-2.20.so 7f0b7ea6e000-7f0b7ea71000 rw-p 00000000 00:00 0 7f0b7ea97000-7f0b7ea9a000 rw-p 00000000 00:00 0 /lib64/ld-2.20.so/lib64/ld-2.20.so 7f0b7ea9c000-7f0b7ea9d000 rw-p 00000000 00:00 0 [stack][vvar][vdso][vsyscall]

 

"Looking for a Similar Assignment? Get Expert Help at an Amazing Discount!"