All About That (Data)Base - SANS DFIR Summit 2016

Описание: All About That (Data)Base

Attackers want it. Your organization uses it every day. Your job is to protect it. It’s where all the sensitive stuff sits: the database. As DFIR professionals, our job is to leave no stone unturned. In this talk, we’re going to expand your DFIR toolkit and show how to incorporate database forensics in your workflow. Databases contain a wealth of information that may help us determine how the attacker got in and what they took. Through memory, disk, and log analysis, we will cover how analyzing the database in concert with other systems helps to paint a better picture of the breach.

This talk goes beyond simply discussing databases forensics, we’re going to get our hands dirty with scripts, memory, and disk analysis. Attendees will learn techniques and methods for performing forensics on MS SQL database systems. We will be releasing new research and tools on carving and analyzing disk- and memory-based artifacts. Attendees will also be exposed to a SQL Database Analysis Framework, which allows them to immediately incorporate these important artifacts into their investigations.

Matt Bromiley, Senior Consultant, Mandiant
Jacob Christie, Consultant, Mandiant