Chapter 10 — Digital forensics and malware analysis: control configuration
Lesson map
Lesson 10 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Retention settings"]
N2["Lab — retention against policy"]
N3["10.2 Reading the result"]
N4["10.3 Fixing retention"]
N5["10.4 Preventive controls"]
N6["10.5 Documenting changes"]
N7["10.6 Verification"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Retention settings"]
N2["Lab — retention against policy"]
N3["10.2 Reading the result"]
N4["10.3 Fixing retention"]
N5["10.4 Preventive controls"]
N6["10.5 Documenting changes"]
N7["10.6 Verification"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX037"]
[Learning outcomes]
|
v
[10.1 Retention settings]
|
v
[Lab — retention against policy]
|
v
[10.2 Reading the result]
|
v
[10.3 Fixing retention]
|
v
[10.4 Preventive controls]
|
v
[10.5 Documenting changes]
|
v
[10.6 Verification]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) check logging and retention settings against policy; (2) configure controls that prevent recurrence; (3) document configuration changes; (4) verify settings after change.
10.1 Retention settings
The hospital's policy sets minimum retention for key logs. During the incident, Sana noticed DHCP records older than two weeks were missing. She checks all key sources.
The gap appeared when Sana tried to look up which PC held an address on an earlier date and found no DHCP record. Rather than treating it as a one-off, she checks every source the investigation relied on against the policy minimums. The lab compares four sources, security logs, proxy, EDR and DHCP, using the values from each system's settings.
Lab — retention against policy
"""Check synthetic log-retention settings against policy minimums (days)."""
policy = {"security": 365, "proxy": 180, "edr": 90, "dhcp": 90}
actual = {"security": 365, "proxy": 30, "edr": 90, "dhcp": 14}
for k in policy:
print(f"{k:9} policy={policy[k]:4} actual={actual[k]:4} {'OK' if actual[k] >= policy[k] else 'BELOW'}")
Run with python3 lab_policy.py. Verified output:
security policy= 365 actual= 365 OK
proxy policy= 180 actual= 30 BELOW
edr policy= 90 actual= 90 OK
dhcp policy= 90 actual= 14 BELOW
10.2 Reading the result
Security logs (365 days) and EDR (90) meet policy. The proxy keeps 30 days against a 180-day minimum, and DHCP 14 days against 90: both BELOW. If the stick had first been used a month earlier, proxy and DHCP evidence would already be gone.
The two sources below policy are exactly the ones that tie network traffic to a ward PC, which makes the gap worse than the numbers suggest. Fourteen days of DHCP means a proxy entry older than two weeks cannot be linked to any device. Security logs and EDR were fine, which is why the USB history was still complete.
10.3 Fixing retention
Change requests raise proxy retention to 180 days and DHCP to 90, with storage estimates approved.
Longer retention needs more storage, so the change requests include estimates that the infrastructure team checks before approval. The records manager confirms that keeping proxy logs for 180 days is consistent with the hospital's records policy. Sana prepares the evidence for the requests, but the network team owns the changes and makes them. Both changes are tracked in the ticket until the retention check confirms the new values.
10.4 Preventive controls
Block execution of scripts and shortcuts from removable media; extend application control to all wards; alert when the script host runs from removable drives.
Each control answers a step in the Ward 4 sequence: blocking removable scripts stops run.vbs, application control stops svch.exe from running, and the alert tells security when wscript.exe starts from drive E: or similar. Application control rollout is agreed ward by ward with managers, since some wards use specialist clinical software. The script-host alert is the one control that also helps detection if the other two fail.
10.5 Documenting changes
Each change has a request, approval, implementation record and test result.
For the proxy retention change, for example, the record shows the request with the case reference, approval by the IT board, the date it was implemented and the retention check result afterwards. Keeping the four parts together lets an auditor see that the change was authorised and actually took effect. Sana attaches each test result to its change record in the same ticket. A change missing any of the four parts is treated as incomplete, and the next weekly check flags it to Owen.
10.6 Verification
After changes, Sana re-runs the retention check and tests the controls with a harmless synthetic shortcut on a test PC: blocked, and an alert raised.
The test shortcut is harmless and synthetic, created on a test PC that is not connected to the clinical network. It checks that the block and the alert both work, without using the real run.vbs or any malware. Rerunning the retention lab after the changes gives a second, independent check that the new settings are in place.
10.7 Readiness
ISO/IEC 27043 includes readiness processes; retention and alerting configuration are readiness in practice.
Readiness means being able to investigate the next incident without the gaps this one exposed. For Westbrook, that means log sources kept as long as policy says, alerts on the behaviour seen on Ward 4 and tested runbooks. The retention check now runs weekly, so drift after an update is noticed within days. Readiness also includes the tested runbook and the kit drive with its location written into it.
Who approves changes
Retention changes need the records manager and the IT board, because longer retention raises privacy and storage questions as well as security ones. Application control rollout needs ward managers' agreement, since a rule that blocks clinical software would harm patients. Sana prepares the evidence; others decide.
Worked example
The post-change check shows proxy 180 OK, DHCP 90 OK. The test shortcut on a lab PC is blocked by application control and generates an EDR alert within one minute. Sana attaches both results to the change records.
Synthetic case. Settings come from the lab script.
Errors and limits
Configuration can drift after updates; schedule regular checks, not one-off fixes.
Exercises
- EX037 — Below policy. Which sources were below policy? Rubric: 3 = proxy 30 vs 180; DHCP 14 vs 90; 2 = one; 1 = wrong; 0 = none.
- EX038 — Impact. Why do short retentions matter for this case? Rubric: 3 = earlier use would have lost proxy/DHCP evidence; 2 = partial; 1 = vague; 0 = none.
- EX039 — Preventive controls. List three preventive controls configured. Rubric: 3 = block removable scripts/shortcuts, app control all wards, script-host alert; 2 = two; 1 = one; 0 = none.
- EX040 — Verification test. How were the controls verified? Rubric: 3 = harmless synthetic shortcut on test PC; blocked and alerted; 2 = partial; 1 = assumed; 0 = none.
Synthesis
Check configuration against policy, fix with documented changes and verify with safe tests.
Continue studying — chapter 10 of 18
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →