Instructor: Eradication. In this lesson 2 2
we're going to move into the eradication and recovery phase. 3 3
When we talk about eradication recovery 4 4
this is going to remove the cause of the incident 5 5
and bring the system back to a secure state. 6 6
When we start with the first part of this 7 7
we're dealing with eradication. 8 8
And eradication is focused on the complete removal 9 9
and destruction of the cause of the incident. 10 10
For example, if your server's been infected with malware 11 11
the eradication is going to be focused 12 12
on methods to remove it 13 13
and suppress its ability to do any further damage. 14 14
Now, the exact method of eradication 15 15
is going to depend on the source of the infection 16 16
or what the specific incident was, 17 17
but for our purposes in our generic planning, 18 18
it really doesn't matter that much. 19 19
Now, later on, when you start dealing with 20 20
a specific situation or an incident that's caused 21 21
by an attacker, that is when the specifics will matter, 22 22
and your team will have to develop a plan 23 23
that will adequately eliminate that threat. 24 24
It's important to make sure 25 25
that you fully have identified the threat, 26 26
and this way you don't miss any signs of the infection 27 27
and you root it out all the way throughout the system. 28 28
There is nothing worse 29 29
than going through all the effort in an instant response 30 30
and then finding out that you had three systems 31 31
that were infected not just one 32 32
with that particular piece of malware. 33 33
And now you have to start all over again 34 34
because it's moving throughout your network 35 35
and the systems are continually getting infected. 36 36
So, the simplest option when you try to eradicate a system 37 37
is to replace it with a clean image from a trusted source. 38 38
If I know this server has an infection on it 39 39
and I can just format it 40 40
and then reinstall a brand new operating system on it 41 41
from a known good image, 42 42
that is going to be the simplest way to eradicate it. 43 43
But, that's not always possible. 44 44
A lot of times you can't just format the hard drive, 45 45
because some malware can actually hide itself 46 46
and bypass itself through a format stage. 47 47
Instead, we don't want to rely on just a quick format. 48 48
We want to make sure we are doing proper sanitization 49 49
and secure disposal. 50 50
Now, when I talk about sanitization, 51 51
this is a group of procedures that organization uses 52 52
to govern the disposal of obsolete information 53 53
and equipment, including storage devices, 54 54
devices with internal data storage capabilities 55 55
or paper records. 56 56
When you're dealing with standardization, 57 57
there are lots of different ways of destroying this data, 58 58
and as I said, 59 59
it's not just as easy as doing a quick format. 60 60
Instead, you have to use one of the more secure methods. 61 61
If you're using a solid state device 62 62
you might have the ability to do a cryptographic erase. 63 63
This is also abbreviated as CE. 64 64
Now, a cryptographic erase 65 65
is a method of sanitizing a self encrypting drive 66 66
by erasing the media encryption key. 67 67
Now, most of the time 68 68
when you're dealing with cryptographic erase, or CE, 69 69
this is going to be a feature of self encrypting drives, 70 70
and these self encrypting drives 71 71
tend to be solid state drives. 72 72
Now, if you're going to be dealing with 73 73
a regular type of hard drive, 74 74
you might have to do what's known as a zero-fill. 75 75
A zero-fill is a method of sanitizing a drive 76 76
by overriding every single bit on that drive with zeros. 77 77
To do this inside of a window system 78 78
you can do a zero-fill using the command prompt 79 79
and the format command. 80 80
You'll type in something like format, 81 81
the drive letter you want to format/fs:NTFS 82 82
to say that you want an NTFS file system 83 83
and then /p:1, which tells it how many passes you want to do 84 84
with the number of zeros over that drive. 85 85
In this example, I'm doing one set of zeros 86 86
across every bit on that drive. 87 87
If I want to do something a little bit more secure 88 88
I might do three sets of zeros, or seven sets of zeros. 89 89
This way I can overrate the drive multiple times 90 90
to make sure I got all that information off. 91 91
Depending on the level of data you have on that 92 92
and the different classification level, 93 93
that's going to determine how many passes you need to do. 94 94
Now, the big problem that we have with a zero-fill though 95 95
is it's really only reliable when you're dealing 96 96
with magnetic media. 97 97
If you're dealing with something like an SSD 98 98
or a hybrid drive, these zero-fill procedures 99 99
are not going to be very useful to you. 100 100
Now, the reason for this is that solid state drives 101 101
and hybrid drives have a wear leveling routine 102 102
built into the drive controller, 103 103
and this helps them communicate which locations 104 104
are available for use by the software. 105 105
So even though you're telling it to do 106 106
a zero across every single bit on that solid state drive, 107 107
if you're using a solid state drive, 108 108
that wear leveling routine might miss some places 109 109
and that means there could be data that could be recovered. 110 110
Now, another thing you can use 111 111
is what's known as a secure erase. 112 112
A secure erase is a method of sanitizing 113 113
a solid state device using manufacturer provided software. 114 114
Again, because of that wear leveling routine 115 115
using this specific secure erase software 116 116
can override that ability of using that wear leveling 117 117
and make sure you get all the data sanitized. 118 118
Now, I mentioned earlier that it's going to depend 119 119
on the type of data you have on a drive 120 120
of which method you're going to use to sanitize it. 121 121
Now, if you have something that is top secret, 122 122
or highly confidential, 123 123
you want to make sure you're sanitizing it 124 124
using secure disposal. 125 125
Now, what is secure disposal? 126 126
Well, secure disposal is a method of sanitizing 127 127
that utilizes physical destruction of the media 128 128
by mechanical shredding, incineration or degaussing. 129 129
Yes, that's right. 130 130
You can actually shred a metal hard drive 131 131
into smaller pieces, and by doing this, 132 132
you can ensure nobody will ever get the data 133 133
off of that drive. 134 134
This level of physical destruction 135 135
is reserved for things that have a very high classification, 136 136
such as proprietary data, top secret government information 137 137
or confidential business transactions. 138 138
Now, most of us aren't going to use secure disposal 139 139
because we don't want to destroy the physical hardware. 140 140
We want to be able to reuse that hardware in our servers 141 141
or in our workstations, and so in those cases, 142 142
we would have to use something like cryptographic erase 143 143
if you're using a self encrypting drive, 144 144
zero-fill if you're going to be using a magnetic drive, 145 145
like the one shown here, 146 146
or secure erase if you're using a solid state device. 147 147
It's important for you to know 148 148
which of these three methods you are going to use 149 149
based on the type of device that you're trying to sanitize. 150 150
Finally, if you want to learn more information 151 151
about sanitizing your media, 152 152
I do recommend you look at the 153 153
NIST Special Publication 800-88. 154 154
This has all the guidelines for media sanitation, 155 155
and it's going to cover all of the different topics 156 156
that you might use in the real world, 157 157
depending on where your organization is 158 158
and what type of business you're doing.