James Kettle

Late night learning (and making a post out of it (for better understanding)) Part - 2: Subject - Digital Forensics Topic - ShellBags ShellBags are registry keys (A registry key is a part of a database in Windows Registry that stores settings and options for the operating system and installed programs) that store metadata related to a user’s folder views in Windows Explorer. While their primary function is to maintain a user’s preference for folder layout (like icon size or view settings), their significance in forensic investigations goes much deeper. When a user accesses a folder, Windows creates a ShellBag entry. What makes this valuable for forensics is that ShellBag entries are preserved even after folders are deleted, moved, or renamed. This means, the forensic guy can reconstruct the history of user interactions with folders that no longer exist on the system. Within ShellBags, two key components stand out: the "BAG MRU" (Most Recently Used) and "BAG keys". BAG Keys: These keys are associated with specific folders and store information about how a user has interacted with them, such as view settings and last accessed timestamps. BAG keys can provide insights into user behavior, revealing which folders were frequently accessed, even if they have been deleted or renamed. This is vital for establishing timelines in investigations. BAG MRU Keys: The MRU keys track the most recently used folders. They can reveal a user’s navigation patterns and preferences over time, providing context around their actions. For example, in cases of data theft or unauthorized access, MRU keys can help forensic investigators determine which folders were accessed just before key actions were taken, thus shedding light on intent. Both the BAG and MRU keys allow forensic investigators to piece together a user’s interaction history, creating a clearer picture of their activities on the system. Even when users believe they have deleted sensitive information, these keys can reveal what was accessed. References used - 1. A book named - Digital forensics and incident response by Gerard Johansen 2. https://lnkd.in/ghc5cuue 3. https://lnkd.in/gRsw3kN8 #DigitalForensics #Security #Learning #GoodNight

6

3 Comments

❓ Are you required to use ISO5338 to meet the Producer and Developer requirements of ISO42001❓ In short, the answer is an emphatic “NO”. Though you’ll have many other solid frameworks to reference (BSIMM, OWASP, PCISSLC, etc.), a natural transition for most of you will be to use NIST SP 800-218A instead of ISO 5338 to meet the requirements of ISO 42001, again, particularly in the context of AI producer and developer roles. ➡ Understanding the Context ISO 42001 focuses on AI management systems (AIMS), ensuring that AI products are developed and managed responsibly and securely. ISO 5338 is a standardized software development lifecycle (SDLC) framework, which can be replaced or complimented by NIST SP 800-218A for building structured, secure AI development practices. 🔑 Key Steps to Align NIST SP 800-218A with ISO 42001 1. Identify Relevant Controls in ISO 42001:   - Review ISO 42001 requirements specifically related to producers and developers, focusing on sections that outline the necessary controls for responsible AI development. 2. Map NIST SP 800-218A Practices to ISO 42001:   - Align the tasks and controls outlined in NIST SP 800-218A with the requirements of ISO 42001. This mapping helps identify which NIST practices meet specific ISO controls (see attached image). 3. Implement NIST SP 800-218A Tasks:   - Apply the identified tasks from NIST SP 800-218A in your AI development processes. Ensure these tasks are documented, executed, and monitored effectively. 🔧 Practical Implementation Steps (NIST SP 800-218A) 1. Define Security Requirements (PO.1.1, PO.1.2):   - Identify and document all security requirements for your AI development processes. This includes requirements specific to AI models, their data, and any associated software components. 2. Establish Roles and Responsibilities (PO.2.1):   - Clearly define roles and responsibilities within your development team. Ensure everyone understands their role in maintaining AI security and compliance. 3. Verification and Validation (PW.7.1, PW.8.1):   - Implement robust verification and validation practices. Regularly review and test code, and include adversarial testing to identify potential vulnerabilities specific to AI systems. 4. Continuous Monitoring (PO.5.3, RV.1.1):   - Set up continuous monitoring for AI systems. Use automated tools to monitor performance, detect anomalies, and gather data on potential vulnerabilities. 5. Documentation and Provenance (PS.3.2, PO.3.3):   - Maintain comprehensive documentation of all AI development activities. Track and safeguard provenance data to ensure the integrity and reliability of AI models and components. For further assistance or specific implementation strategies, feel free to reach out! A-LIGN #iso42001 #NISTAISSDF #TheBusinessofCompliance #ComplianceAlignedtoYou 🌐 https://lnkd.in/exqUwHt4

20

A few recent improvements by the team (🤘) to centrally collect and export forensic data from cloud resources like VMs and Containers, as well as on-premise systems: - Centrally store the evidence as .dd, .e01 or .zip - Download and export to your existing forensic tools - Download files from acquired systems, using “encrypted zip” for suspect files. -- Similar to VirusTotal Intelligence's Download File functionality for those who know it, but for your own data. All part of helping you build a central “Repeatable Investigation Process”

26

3 Comments

PTaaS VS BugBounty... PTaaS (Penetration Testing as a Service): ✅ Actively tackles the root cause of vulnerabilities ✅ Strives to find fewer issues over time Bug Bounties: ✅ Celebrate finding vulnerabilities ✅ Thrive on ever-growing bounty pots Which approach is more suitable for a lean security budget? #CyberSecurity #PTaaS #BugBounty #Infosec

22

3 Comments