◇ OpenCyber Academy
Technical · Chapter 15 · English

Chapter 15 — Digital forensics and malware analysis: integration and dependencies

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 15 — Digital forensics and malware analysis: integration and dependencies

Lesson map

Lesson 15 published. Map, example, EX057.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 Dependency map"]
  N2["15.2 Single points of failure"]
  N3["15.3 Coordinating owners"]
  N4["15.4 Clinical dependencies"]
  N5["15.5 Planning for loss"]
  N6["15.6 Integration"]
  N7["15.7 Review"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX057"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 Dependency map"]
  N2["15.2 Single points of failure"]
  N3["15.3 Coordinating owners"]
  N4["15.4 Clinical dependencies"]
  N5["15.5 Planning for loss"]
  N6["15.6 Integration"]
  N7["15.7 Review"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX057"]

[Learning outcomes]
    |
    v
[15.1 Dependency map]
    |
    v
[15.2 Single points of failure]
    |
    v
[15.3 Coordinating owners]
    |
    v
[15.4 Clinical dependencies]
    |
    v
[15.5 Planning for loss]
    |
    v
[15.6 Integration]
    |
    v
[15.7 Review]
    |
    v
[Worked example] --> [Exercise EX057]

Learning outcomes

You will (1) map the systems the investigation depends on; (2) identify single points of failure; (3) coordinate with teams that own dependencies; (4) plan for dependency loss.

15.1 Dependency map

The investigation relied on the EDR console, central log store, proxy, DHCP server, time server, switch logs, the kit drive and the external malware analyst. Each has an owner.

Each of these was needed at some point: DHCP for attribution, the time server for the skew, switch logs for the PHARM-PC3 gap and the analyst for svch.exe. Naming an owner for each tells responders whose queue to use during an incident. The map is kept with the runbooks rather than in the case file.

15.2 Single points of failure

The central log store has no replica: if it failed, proxy and security logs would be lost. The kit drive exists in two copies, but only one is kept up to date. The malware analysis contract allows two samples per month.

Each single point was found by asking what would happen if that dependency failed during the Ward 4 case. Losing the log store would have removed the proxy records that linked both PCs to the domain. With only one kit copy current, a lost or borrowed drive would leave responders with an outdated tool set at the moment they need it.

15.3 Coordinating owners

Proxy and DHCP belong to the network team; the time server to infrastructure; the EDR to security. Sana's requests to each go through their queues with case references, not personal favours.

Working through queues means each request has a reference, a priority and an owner who can be asked about it later. Personal favours leave no record and fail when the person is away. Sana's request for the switch log during the PHARM-PC3 gap went through the network team's queue in the same way.

15.4 Clinical dependencies

Ward PCs support medication and rota systems. Containing WARD4-PC2 affected Ward 4's access to the medication chart viewer; the ward used a spare PC. Responders consider clinical impact before acting.

Responders first ask what the PC is used for and agree any action with the ward manager. On Ward 4, the containment of WARD4-PC2 was accepted because a spare PC could reach the medication chart viewer. On a ward without a spare, the decision might have been different and would have been escalated.

15.5 Planning for loss

For each dependency, the plan records what happens if it fails: e.g. if the EDR console is down, local event logs are collected by the triage tool.

Writing fallbacks before an incident means responders do not have to invent them under pressure. For the time server, the fallback is comparing each PC with a reference clock at collection, as Sana did on WARD4-PC2. For the analyst, it is the purchase approval route for a sample beyond the monthly allowance.

15.6 Integration

Exports from each system use the same time zone (UTC) and include host identifiers, so they merge cleanly.

UTC avoids confusion around clock changes and between systems set to different local zones. Host identifiers in every export let records from EDR, proxy and DHCP be joined without guessing. When a system cannot export in UTC, its zone is recorded and converted before merging. The DHCP, proxy and EDR exports for the Ward 4 case all used UTC, which made the merged timeline straightforward.

15.7 Review

The map is reviewed twice a year.

Twice a year is often enough for a small hospital team, and any project that adds or removes a dependency also triggers an update. Each review checks owners, fallbacks and contract limits against what is now in place. The log store replica requested in change 2291 is one item the next review confirms. The review also checks whether the kit drive's second copy has been brought up to date. Any change found at review is recorded with its date and owner.

Contracts and limits

External dependencies are governed by contracts. The analysis contract's two-sample monthly limit meant run.vbs and svch.exe used the whole allowance; a third sample would have needed a purchase approval. Sana records contract limits in the map so responders know them before an incident, not during one.

Worked example

Sana's map row: "Central log store — owner: infrastructure; holds proxy, security logs; no replica (single point of failure); fallback: none; action: replica requested (change 2291)."

Synthetic case. The map is invented.

Errors and limits

Maps go stale; dependencies change with projects.

Exercises

Synthesis

Know what the investigation depends on, who owns it and what to do when it fails.

Continue studying — chapter 15 of 18

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →