This is a practice-oriented course that provides the basic knowledge required to perform duties as a security analyst and conducts incident analysis training through hands-on exercises. We will explore incident analysis methods from a practical perspective necessary for corporate intrusion response and analysis tasks.
According to Article 2, Paragraph 1, Item 7 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., an "infringement incident" refers to "a situation caused by an attack on an information and communications network or related information systems through methods such as hacking, computer viruses, logic bombs, mail bombs, denial of service, or high-power electromagnetic waves."
Security incidents occurring in information asset-related systems refer to cases where abnormal behavior occurs in systems and applications, or phenomena unintended by the administrator (deletion, modification, leakage, etc.) are caused by an attacker.
When a cyber security incident occurs, a company must quickly identify the scope of the damage and minimize the business impact through incident recovery. If activities required for compliance with industry laws or regulations are omitted, penalties or additional enforcement items may arise according to relevant laws or regulations. To minimize business impact, the entire enterprise—including the security team, PR team, and legal team—focuses on incident response. To prepare for potential security incidents, companies conduct annual or quarterly mock drills to practice the essential activities required for response.
Security analysts perform incident analysis when a security breach or legal issue occurs within a company or organization. To identify the causes of system anomalies arising from various factors, they must possess the capability to distinguish between these problematic situations. In particular, when an intrusion by an outsider or a breach by an internal employee occurs, the role of a security analyst is to conduct incident analysis to assess system damage and analyze the cause of the breach.
In order to analyze the damage to a company and derive response measures to prevent recurrence, it is most important to analyze the exact cause of the incident. However, in reality, experiencing the actual incident analysis process is very rare and difficult.
The term “Big Root” is generally used to emphasize the complexity of a problem or situation. “Big Root” means that the root of the problem is large and complex. This indicates that the problem is not limited to a single simple cause or factor, but rather that various factors are intricately intertwined.
Incidents caused by advanced cyberattacks are also difficult to resolve by analyzing only the systems visible on the surface. These sophisticated attacks lead to recurring incidents and cause continuous damage to a company's business. To identify the root cause and intrusion vector of a security incident, corporate security teams must examine information from various systems and solutions during the analysis process.
Through this lecture, we will explain the incident response procedures and learn about the types and causes of cybersecurity incidents that cause serious damage to companies. You will also learn the skills necessary to fundamentally resolve the security vulnerabilities that cause hacking incidents.
From concept to practice The fundamentals of incident analysis.
Through incident analysis training similar to real-world cases, you can improve your incident analysis capabilities.
We will acquire the basic knowledge required to perform duties as a security analyst and practice using analysis tools.
Based on an understanding of network communications and applications, we identify the causes of cyber security incidents.
By analyzing threat logs generated from various security devices, you can identify attackers attempting to intrude.
Learn practical incident analysis methods required for corporate intrusion response and analysis tasks.
In this course, we will examine practical incident analysis methods required for performing intrusion response and analysis tasks within an enterprise. We provide practitioners performing network-based intrusion detection log or network packet analysis with the knowledge required by security analysts and know-how on using analysis tools, while explaining what results should be sought through analysis.
In particular, performing security analysis involves using various logs and analysis tools. For those who wish to work in intrusion detection system log analysis, web server logs, and network packet analysis, I intend to explain the basic concepts of threat analysis and practical techniques. By explaining the fundamental concepts and techniques alongside the know-how acquired through the author's professional experience, I aim to help students improve their job performance capabilities.
The information typically analyzed for incident analysis includes web logs, IDS/IPS logs, and network packet logs. We plan to conduct incident response training by analyzing logs from systems where actual security incidents occurred. Finally, we will also share insights on how to manage and develop your future career from a professional career management perspective.
Efficient analysis learning is here to help.
Intrusion Response/Analysis Information Collection Methods Required for Practical Work
Analysis tools and usage methods used by incident response/analysis practitioners
Incident Response/Analysis Practical Know-how through Case Studies
1) Learn the analysis tools and methodological techniques used by incident response/analysis practitioners.
If you do not have much experience in incident analysis, you may feel overwhelmed about where to start an investigation. Through this course, you will practice various types of incident cases so that an analyst can quickly find the cause of an incident and identify the attack path. Through hands-on practice, you will learn what to focus on to find traces of an incident when analyzing security logs and how to analyze them efficiently.
✅ Learning case studies on criteria for distinguishing normal logs
✅ Practice using mass log analysis programs
✅ Learning types of security incidents
2) Through analysis methods that are not dependent on specific hacking techniques, it is possible to apply and adapt to various situations.
Attackers attempt to infiltrate systems using various methods. By understanding the principles of how vulnerabilities are exploited, rather than being dependent on specific attack tools or methods, you will be able to apply and perform analysis on a wide range of security attack attempts.
Security analysis practice for training.
IDS Log Analysis Training
A portion of the attack behavior logs detected by commercial security products has been filtered and provided for practice. The attack event names, attack times, and other information are configured identically to actual incident cases.
Web Log Analysis Training
You will directly analyze the attack techniques used against the web server and the logs remaining on the target server. Through this analysis, you will identify vulnerable configurations of the web server and determine the cause of the incident.
Network Packet Analysis
Cybersecurity incident cases were reproduced under the same conditions in a lab environment, and network traffic was captured by replicating the process of attacking a system from an attacker's perspective. The captured packets are then analyzed to determine the target of the attack and the scope of the damage.
📣 Please check before taking the course!
The attacker IP and target IP in the logs used for the practice have been modified for the purpose of the exercise.
Learning Content 📚
You can learn the analysis process by practicing incident analysis through various hands-on cases. Before learning through the guided analysis process, try performing the analysis yourself first, and then compare your own process with the contents of the analysis guide.
Section 1 - Pre-learning
Before the practice, we will examine the methodologies required for analysis. We will learn how to analyze by distinguishing between identifying attack behaviors based on specific patterns and identifying threats by setting thresholds based on behavior. Then, we will look at how to apply these to security incident cases through examples of identifying abnormal behavior in movies.
Reference video for identifying abnormal behavior in movies (Click)
Analyze the intrusion detection solution events detected during a specific period to determine the cause of the large-scale network failure. The following table shows the intrusion detection events extracted from the intrusion detection system.
Detection Item
Detection Information
Event Collection Period
3 months
Detection Signature Name
TCP_Invalid_SACK
Source IP
10.0.0.1
Source Port
Random
Destination IP
Random
Destination Port
Random
Total
1441 cases
The intrusion detection system signature known as TCP_Invalid_SACK is triggered by abnormal SYN and ACK packets. Generally, TCP communication involves exchanging necessary communication packets according to the methods defined in the protocol. However, depending on the programs used for communication or network characteristics, communication may occur in a manner that deviates from the established protocol. The TCP_Invalid_SACK signature records these occurrences.
For this reason, communication history is detected even when an attacker uses non-standard programs. Of course, the detected information does not only record the attacker's communications. Among the 1,441 detected events, the number of times the attacker communicated will likely be small. A security analyst must identify those few instances of attack detection through event analysis.
We will trace the cause of the incident through the process of directly analyzing the provided practice log files. The results of the analysis regarding the cause of the incident are explained in the Analysis Guide section. As emphasized earlier, you will conduct incident analysis training by first analyzing the process yourself and then comparing your findings with the contents of the Analysis Guide section.
We analyze the circumstances of an incident on a compromised system through web log analysis. Log processing is a task aimed at analyzing events more efficiently by removing unanalyzed or unnecessary information. However, this traffic is as vast as a haystack. Finding attack traffic, which is like a needle hidden in a haystack, is by no means an easy task.
In the second practice session, we will look at how to clear away the haystack using web logs. Let's install Splunk, Log Parser, and Elasticsearch and practice the process of analyzing Windows web server logs.
An attacker who bypassed file extension restrictions uploads an application executable (ASP extension file) to the bulletin board and takes control of the system. Let's analyze the web shell attack carried out through network communication. The packet analysis process allows for highly efficient breach analysis simply by selecting the target communication or server analysis scope. To analyze web shell communication packets, we will use filter syntax commonly used in analysis to examine the packets efficiently.
In the analysis process, let's extract the backdoor files executed through actual network communication and track what communication took place and what damage was caused to the server through reproduction.
Q&A 💬
Q. What is the prerequisite knowledge required for learning?
This course is primarily practice-oriented. It does not include basic concepts or theories of cybersecurity. To perform the exercises in this course, you need an understanding of IDS, as well as web application configurations and web server response codes. While prior knowledge is required, you can perform incident analysis even if you have no prior experience with hacking.
Q. How is this different from other security lectures?
The course content is centered around practical experience in security incident analysis techniques and know-how. Since all three incident analysis cases are adapted from real-world incidents, you can enhance your security incident analysis skills. However, please note that the forensic process in a legal sense, such as collecting disk images, will not be covered.
Q. Are there any notes regarding the course?
The practice sessions utilize open-source tools (MS Log Parser Studio, Wireshark), free trial security products, and Microsoft EXCEL. The installation process for the analysis products is omitted from the practice content. Students must proceed with individual installations by referring to the installation guide links provided by each product's manufacturer.
The instructor of this course is ✒️
Bigroot Security
I have been active for 18 years as a CERT team incident response expert and a solution engineer for foreign security companies. I served as the PM for SOC construction and operation projects at IBM Korea. I performed tasks related to security infrastructure design and the development of construction/operation processes. At the AhnLab CERT team, I conducted security incident analysis & response for private companies and public institutions. During the 3.20 DarkSeoul campaign, I performed system inspections for domestic broadcasting stations, and I supported the inspection of compromised systems during the Nate personal information leak incident.
Key Experience
Security Consultant: Designing, building, and operating security enhancement strategies through security infrastructure consulting
Security Operations Center (SOC) Consulting: Performed SOC establishment consulting and operational tasks
Security Service Product Development: Next-Generation SOC Solution & Service Development
Incident Response: Numerous cases including military, public, and private sectors
I performed security incident analysis and response for private companies and public institutions as a member of the AhnLab CERT team. During the March 20 DarkSeoul campaign, I conducted system inspections for domestic broadcasting stations, and I also supported the investigation of compromised systems during the Nate personal information leak incident. I have carried out numerous digital forensic investigations into various security breaches targeting both private and public sector organizations.
At IBM Korea, I served as a PM for SOC implementation and operations projects, where I was responsible for designing security infrastructure and developing deployment and operational processes.
As a technical security solution specialist at Cisco Korea, I diagnosed customer environments and provided strategic advice on improvements, leveraging my expertise in security architecture design and threat response scenarios.
I am currently working as a solution engineer at a foreign security firm.
• Security Consultant: Designed, built, and operated security enhancement strategies through security infrastructure consulting
• Security Operations Center (SOC) Consulting: Performed SOC establishment consulting and operational tasks
• Security Consultant: Designed, implemented, and operated security enhancement strategies through security infrastructure consulting
• Security Operations Center (SOC) Consulting: Performed SOC establishment consulting and operational tasks
• Security Service Product Development: Development of next-generation security monitoring solutions & services
• Incident Response: Numerous cases across military, public, and private sectors
Consulting: Performed SOC establishment consulting and operations • Security Service Product Development: Developed next-generation security monitoring solutions & services • Incident Response: Numerous cases across military, public, and private sectors
Consulting: Performed SOC establishment consulting and operations • Security Service Product Development: Developed next-generation security monitoring solutions & services • Incident Response: Numerous cases across military, public, and private sectors
It's such a shame.
I wanted to study the infringement accident practice rather than the introductory talk that can be easily found on YouTube,
but in the actual practice, there is no explanation at all, and you proceed alone and only talk about the conclusion.
Also, from the middle, strange background music suddenly keeps playing... I can't hear the explanation at all.
The practice video seems to be quite old based on the file modification date and such.
Hello, this is Song Dae-geun. Thank you for sharing your course review.
The three practical contents included in the lecture are designed to maximize the practical skills of the learner by performing analysis directly as a breach incident analyst and achieving the practical objectives (e.g., identifying the attacker IP, etc.). The learning objective of the practical contents is to analyze the practical textbook directly, derive answers to the questions in the practical objectives, and review the analysis results by comparing them with the actual breach incident analysis results in the next chapter (practical review) and confirm the answers to the questions in the practical objectives. However, if you had any difficulties with the practical or have any questions while analyzing the three practical textbooks, please register in “Ask a Question”. We will answer your questions after checking the related content.
If you let us know of any videos among the three practical review videos where the lecture explanation cannot be heard due to audio, we will update them by correcting the balance of the background music.
The files related to the practical were selected as practical textbooks based on representative attack cases (e.g., the 3.20 Internet crisis) at the time when the actual incident occurred. Reference - https://namu.wiki/w/3.20%20%EC%A0%84%EC%82%B0%EB%A7%9D%20%EB%A7%88%EB%B9%84%EC%82%AC%ED%83%9C
Thank you for taking the class until the end of the hot summer.
![Digital Forensics Expert Level 2 Written Exam Core Summary Book [E-book]Course Thumbnail](https://cdn.inflearn.com/public/courses/330340/cover/2134a655-fc3b-460d-ad21-55faa7f50443/330340-eng.png?w=420)
![[Easy for Non-Majors] Information Security Incidents: From Cause Analysis by Type to SolutionsCourse Thumbnail](https://cdn.inflearn.com/public/files/courses/342007/cover/ai/2/785d01a5-f55f-4807-b882-6dcbfe3d7f91.png?w=420)
![[OT Security-Common] Understanding the AI Era through Manufacturing Security Field CasesCourse Thumbnail](https://cdn.inflearn.com/public/files/courses/341942/cover/ai/0/a992253a-0431-4396-9212-69d5390e6c2d.png?w=420)
![[OT Security - ② Semiconductor Industry] Understanding manufacturing security through real-world cases in the AI eraCourse Thumbnail](https://cdn.inflearn.com/public/files/courses/342482/cover/ai/2/2bf1148a-a9d7-483c-af96-a058bf9ad5f8.png?w=420)