Forensics expert Rob Lee says its not new types of attacks that concern him. It's the old ones that continue to impact organizations. How can organizations learn from past incidents and respond in 2013?
The bulk of the cases he investigates are external breaches, not insider cases, says Lee, a seasoned forensics professional and curriculum lead and author for digital forensic and incident response training at the SANS Institute. When analyzing the incidents and reporting back to technical teams or executives, he's often faced with the question, "How do we stop this?"
"Even though we're learning more about what the capabilities are of the hackers and adversaries, we have not done a decent job of being able to truly implement solutions that will slow them down ... and even stop the initial infiltration," he says in an interview with Information Security Media Group [transcript below].
Moving forward, organizations need to address the breach at the point of data exfiltration.
"That ends up being a much louder and significant event on a host and a network and much easier to detect as a result," Lee explains.
The main trend heading into 2013 will be for enterprises to formulate effective breach responses to tactics that continue to overwhelm them. And to get to that point, organizations need to embrace the power of big data, which has been difficult for some entities because of the sheer amount of information gathered within an enterprise.
"But as we're moving forward, we're starting to see some solutions creep forward that will give us that visualization and give us the capabilities to identify these anomalies as they're ongoing," Lee says.
In an interview about the process, skills and tools needed in a forensics investigation, Lee discusses:
Typical investigations he conducts;
Attack trends and what we can learn from them;
Most important skills for forensics pros to master.
read more...........http://www.govinfosecurity.com/forensics-trends-for-2013-a-5400