The RSA Security Conference was held this week in San Francisco. The conference is jammed packed with sessions, whiteboarding events, demonstrations, and more. Here are my observations and interview sound bites. I was covering RSA San Francisco 2010 as a forensic analyst and co-host of The CyberJungle, a weekly live news and talk program on security, privacy, and the law.
Digital forensics is still the non-sexy topic at RSA Security. There were no dedicated forensics tracks for this conference. But computer forensics were mentioned now and then in session talks, although many times by the audience more than the speakers.
Smart Grid Forensics
For example, there was an industry panel on electric smart grid security standards. The panelists in this session did not have forensics on their agenda, but a member of the audience did. Gerry Brown is an independent forensics consultant. He was an audience member in this session, and took to the mic to question whether the industry is preparing properly for incident response and evidence gathering in the event of a smart-grid related electrical disruption. I caught up with him right after the session, You can listen to that audio interview here, it’s about 7 minutes long.
Christopher Brown did a purely forensic talk on Thursday afternoon. He talked about the challenges of relying upon system time stamps for evidence collection. His talk was very informative, and he is a good speaker. Unfortunately, there were less than 30 people were attending the session. The forensics industry might still have a long way to go in making this area of infosec “sexy.” Brown wrote a book on forensic evidence collection, entitled, “Computer Evidence: Collection & Preservation.” Here is a guy that might shed some light on the issues that Gerry Brown brought up. After Chris’ talk, I caught up with him to get his take on the concern that Gerry Brown raised in the smart grid session about the challenges in forensic evidence collection as it relates to smart grid incident response. You can listen to that audio interview here, it’s about 7 minutes long.
Mariposa Botnet and Related Forensics
During the RSA Conference there was a major arrest and take down on a large EU botnet, called “Mariposa.” Panda Security worked with Spanish LE, and researchers at Georgia Tech on incident response, and information gathering for the arrests. The attackers used malware that is very difficult to detect. I interviewed Pedro Bustamante from Panda Security about the very stealthy nature of the malware used by the attackers. Pedro speculated that he might be giving an in-depth talk at a future conference about this botnet and the related attacks. You can listen to that audio interview here, and this interview is about 8 minutes long.
Cloud Computing Forensics
There was a dedicated legal session related to Cloud Computing, and the issues of forensics and ediscovery were a topic of that session. Too often executive decision-makers will rush in to buy a Cloud Computing solution, focusing only on the monthly savings. The members of this panel strongly recommended that legal and forensics specialists should be part of the pre-purchase process. Some of the issues that are not often brought up until after the data has moved into the cloud include data de-duplication. When a cloud provider de-dupes, he wipes out the original meta data. This could have a huge negative impact in the event of litigation. Many contracts do not have provisions to spell out mutually agreed upon procedures for incident response for data in the cloud. Too often these items come up long after the contracts are signed, giving the customer much less leverage in getting the vendor to change procedures.
