Effective Victim Interview Techniques for Incident Responders · 2019-06-19 · Interviewing Tips...
Transcript of Effective Victim Interview Techniques for Incident Responders · 2019-06-19 · Interviewing Tips...
EffectiveVictimInterviewTechniquesforIncidentRespondersAlisonNaylorPrincipalInformationSecurityAnalystRedHat,Inc.
Overview
• InterviewBasics• WhyinterviewaspartofIncidentResponse?• Subject(victimorpersonofinterest)interviewingtechniques• QualityQuestions• ActiveListeningandEmotionalIntelligence
• StructureofanIncidentResponseInterview• CaseStudies
WhyInterviewforIncidentResponse?
• Gathermoreinformation(obviously)• Youmayalreadyknowwhathappened,nowfindoutthehowandwhy
• Opportunityforusereducation• Incidentsareamemorableexperience!
• PositivePRforsecurityteam• Showyourusershowyoukeeptheirdatasafe• Securityfolksarepeopletoo!
Whythistalk?
• Manyofusareintroverts• Lessthancomfortabletalkingtostrangers
• Ourquestionsaren’tthatgood• Wetendtofocusonthetech,nottheperson• Oftenmisstheinformationgaps
• Interviewingisaskillwecandevelop• Guidelinestobuildconfidence• Plan,practice,andputintouse!
TypesofSubjects• Victim
• Theincidenthappened“to”them• Wasscammed,orperhapsjustmadeamistake• Usuallycooperative
• Adversarialsubject• Personofinterest• May(ormaynot)betheactorbehindtheincident• Lessthancooperative
“Subject”referstoeithercase–thepersonweareinterviewing
TypesofQuestions
Closed-endedQuestions• Usuallyelicitashort,one-wordanswer(usuallyyesorno)• Usefultoconfirmfacts• Oftenbeginwith“Doyou..”“Canyou..”“Who”“When”“Where”• Mightmakevictimsanxious• Couldmakeadversarialsubjectshostileorclamup• Canimplyjudgment,oranexpectedanswer
TypesofQuestions
Open-endedQuestions• Encourageafull,meaningfulanswerusingboththesubject’sexperiencesandfeelings• Usuallybeginwith“Tellme..”“Whatdoyouthink..”“How”or“Why”• Arereassuringtovictims• Canmakeadversarialsubjectsnervousandchatty• Moreobjective,lessleading
Closed-Endedvs.Open-Ended
“Canyoutellmewhathappened?”“Doyouknowthesenderofthisemail?”“Doyouhaveanyproblemswithyourboss?”
“Okay,tellmewhathappened.”“Howdoyouknowthisperson?”“Tellmeaboutyourrelationshipwithyourboss.”
Whentousethem?
Asageneralrule:• Open-endedquestionstostartaconversation• Closed-endedquestionstoclarify,confirmdetails• Backtoopen-endedtocontinueanarrative
Forparticularlyinvolvedincidents,atraditionalfour-stageinterrogationcanhelp.Weaskthesubjecttodescribe:• Theentireincident,astheyrememberit(mostlyopen-endedquestions)• Theperiodbeforetheincidenttookplace(someopen,someclosed)• Detailsabouttheincident(mostlyclosed)• Theperiodfollowingtheincident(someopen,someclosed)
OrganizingaNarrativeFlow
QualityQuestions
• Objective• SpecificandDirect
• Non-Judgmental• Don’tplayStupidvs.Evil
• Adapttothesubject• Showthatyou’relistening
• Toneofvoice• Matter-of-fact• Supportive
Itlookslikeyouvisitedalinkatsketchy[.]site.Howdidyoucometoreachthatsite?Idon’tseetheURLinyourbrowserhistory,butIhavenetworklogsindicatingthesitewasvisitedatthistimefromyourIPaddress.Whymightthatmightbe?Iheardyousaythatoncetheyhadremotecontrolofyourdesktop,theyransomecommands.Whatcanyourememberaboutthis?
InterviewingTips
Establishrapport• Taketimeforintroductions• Setexpectationsfortheinterview• Offerreassurances• Themagicwords:“You’renotintrouble.”
Bepatient!Don’trush• Repeatandrephraseasneeded• Bookmoretimethanyouthinkyouneed
InterviewingTips
UseActiveListening• Paraphrase–restatethesubject’sinformationwithdifferentwords• Summarize–conciselyreiteratemainpointstoidentifyoverallprogress• Clarify–allowforunclearportionstoberestateduntilintendedmeaningisclear• Reflect–beattunedtoandreflectfeelings
BeMindfulofBodyLanguage• Makeeyecontact• Relaxed,open• Neutralexpression
InterviewingTips
ConsidertheInterviewEnvironment• Howwillthesettingaffectthesubject?• Boardroomvs.ComfyChairsvs.CubicleAmbush
BringaPartner
• Oneofyoucanfocusonthesubject• Theothercanfocusoncapturingdata,fact-checking• Goodtohaveawitness(especiallyifadversarial)
SpecialConsiderationsforVictims
• Victimsmayfeeltraumatized—lookforsignsofdistress• Recognizethevictim’sfears,embarrassment,guilt,orconfusion• Establishasafespace—physicalandotherwise• Offerreassurancespriortoaskinguncomfortablequestions
• Particularlyaroundbrowserhistory,emails,photos,chatlogs,etc.
• Avoidgettingboggeddownspeculatingabouttheadversary• Shareapersonalstoryifyou’veexperiencedsomethingsimilar
It’snotourroletocounselvictimsofcybercrime,butwecanlistenwithempathy,anddirectvictimstoadditional
resourcesthatcanhelp.
EffectsofCybercrime
• Traumacanleadtolong-lastingpsychologicaleffects:• Self-blame,guilt,anger• Feelingvulnerable,powerless• Isolation,inabilitytotrust
• Physicaleffectscaninclude:• Difficultyconcentrating• Appetitechanges• Insomnia• Absenteeism
Source:https://www.infosecurity-magazine.com/news/isc2congress-cybercrime-victims/
BeforeYourInterview
• Planoutyourquestions• Determinewhatbackgrounddatayoumustrecordforeveryincident.Askyoursubjectonlyforthefactsyoucan’tdiscoverthroughothermeans.
• Developquestionstailoredtotheparticularincident• Youmayalreadyhavetheanswers(thatcanbeagoodthing)
• Tryoutquestionsonateammate—rewriteclosedquestionsasopen!
• Chooseatimeandplace• Selectalocationappropriateforyoursubject• Bookmoretimethanyouthinkyou’llneed
BackgroundData
• Subjectprofile:name,userid,emailaddress,phonenumber,jobtitle,hiredate,department,location• Deviceprofile:type,manufacturer,revision,operatingsystem,patchlevel,statusofbackups,statusofdiskencryption• Softwareprofile:packagesinstalled,versions,whatAVorendpointprotectionsoftwareispresent,whatMDMprofileispresent,whatclassificationofdatamaybestoredonthesystemorpassthroughthesystem,etc.
IOC/ArtifactCollectionChecklist
Collectthefollowingtocorrelatewithsystemlogs,networktrafficrecords,packetcaptures,IDSlogs,AVreports,forensictools,andthird-partyanalysissites:• Devicevitals:IPaddress,MACaddress,FQDN,localcomputername• Emailmetadata:To,From,Date,Subject,Attachmentname
• Copyoftheemailwithfullheadersandattachmentpayloadpreferred!• Phonecallmetadata:Phonenumbers,CallerID,timestamps,anddurations• Externalentities:IPAddresses,ports,domainnames,URLs,ASNs• Forensicartifacts:Files,hashes,payloads,memorydumps,diskimages,backups
BeginningYourInterview
• Introduceyourself,givethemachancetodothesame• Explainthepurposeoftheinterview• Offerreassurances—thisisaboutinformation,notblame
• “Weneedyourhelptounderstandwhathappened.”
• Ifappropriate,usethemagicwords:• “You’renotintrouble!”
• Setexpectations—whatyou’llbeasking,whetheryouaretakingnotesorrecording,ifyou’llbeexamininganyartifactsintheirpresence• Smile,useeyecontact,andspeakcalmly!
SubjectHistory
• Askyoursubjecttorecountwhathappened.Encouragethemtotaketheirtime,startatthebeginning,includeasmuchdetailastheycan.• Recorddetailednotesonallstatementsprovidedbythevictim.• Correlatewithyourincidenttimelineasmuchaspossible.Includetimestampsfromeventlogs,emails,chatlogs,etc.whenavailable.• Gentlyaskforadditionalinformationandclarificationasneeded.
PanicMode?
• Askthesubjectwhatstepstheytookoncetheysuspectedaproblem.• Didtheytrytodoanycleanupontheirownbeforeengagingthesecurityteam?• Whatspecificactionsweretaken?
• Passwordschanged?Historycleared?Systemunplugged?Softwareuninstalled?• Whoelsemighthavetheyspokentoabouttheincident?• Whatprotectivemeasuresdidtheyalreadyhaveinplace,andwhatwastheireffectiveness?
• Havetheyexperiencedasimilarincidentbefore?
AdditionalData
• Usualphysicallocation(s)ofdevice• Whoownsthedevice?Isitcompany-provided,orpersonal?• Whoelsehasaccesstothedevice/account?
• You’veneverletyourassistant/teammate/partner/child/parentuseit?
• Isanysuspiciousactivityongoing?• Isthedevicecurrentlyconnectedtoanynetwork?• Hasthedevicebeenpoweredofforrebooted?• Haveanychangesbeenmadetothedevice?
InterviewWrap-Up
Attheconclusionoftheinterview,it’simportantto:• Thankthesubjectfortheirtimeandcooperation• Offeranopportunityforthemtoaskanyquestions
• e.g.nextsteps,whatwillhappenwiththeircase• Askiftheyhaveanyconcernsarisingfromtheincident• Provideyourcontactinformation,incasetheyremembersomethingelse
UserEducation
• Helptheuserunderstandwaystopreventfutureincidents:• Whenindoubt,confirmidentitiesviaanothermethod
• Passwords• Changeanysuspectpasswords• Usegoodpassphrases,2FAwhereverpossible• Don’tre-usepasswords• Useapasswordmanager
• Prepareforpossibilityofre-victimization• Compromiseddatacanbere-sold,usedagain
AdditionalSupport
• Offersuggestionsforadditionalsupport:• EmployeeAssistancePrograms• Creditmonitoringservices• NationalIdentityTheftVictimsAssistanceNetwork• CybercrimeSupportNetwork
• Encouragethesubjecttoreachoutiftheyrecallanyfurtherdetails• Anoverallpositiveinteractionwillincreaselikelihoodofre-contact
CaseStudy:CryptominerChris
• Trackingdownacryptominerinanofficebuilding• Unknownsystem,hadn’tauthenticatedtoanythingofficial• FoundtheMACaddressonaswitch,tracedoutthecable• Approachedtheassociateattheirdesk• “WHAT’SYOURMACADDRESS?!”• Theassociatepromptlyclamsupandbecomesuncooperative• “Let’sstartover”J
CaseStudy:CryptominerChris
Thisinterviewstartedoutreallypoorly,butwewereabletoturnitaround• Reallyhadtocalmdowntheassociate—sittingateyelevel,soothingvoice,etc.• Explainedwhoweare,thatwe’retryingtounderstanddata,andneededhishelp• Askedabouthiscompany-issuedlaptopfirst,butitdidn’tmatchwhatwe’dseen• ThenInoticedanotherPConthedesk—hesaiditwasn’this• Lotsofopen-endedquestionslater,admittedhe’dlifteditfromane-wastebin• Hehadbroughtittohisdesk,pluggeditin,turnediton,andwalkedaway• Hewasusedtore-usingeveryscrapofhardware,thoughtthatwasstandard• Excellentopportunityforusereducationaboutplugginginunknowndevices!
CaseStudy:PhotoPhil
• Threateningtweetswithphotosfrominsideacompanyevent• Triangulatingwhotookthephotofromshotsofthecrowd• Wefoundalow-resolutioncrowdshotpostedonaninternalblogthatcouldpotentiallysolvethemystery• Approachedthephotographer:“Didyoutakethisphoto?We’regoingtoneedyoutohandovertheoriginal!”• Photographerfreakedout!• “Ohmygod,whoevenareyouguys?Idon’thavetogiveyouanything!Nobodygetsmyphotos,they’remine!”
CaseStudy:PhotoPhil
Themagicwords:“You’renotintrouble.Wereallyneedyourhelptofigureoutwhat’sgoingon.Canyouhelpussolvethismystery?”• Timewasoftheessence,unfortunatelyplanningwasnon-existent• Anothercaseofanoverly-intimidatingstarttotheconversation• Alwaysleadwithwhoyouare,whyyou’retalkingtothem,andthatthey’renotintrouble.• Thisassociatewassuperhappytohelponceherealizeditwasn’tabouthim,veryexcitedandproudthathecouldhelpuscrackthecase!
CaseStudy:ScammerFiction,DoubleFeature
1. Associate’sAmazonaccountwascredential-stuffedandcompromised2. Shewantedtotalktotechsupport,soGoogleditandcalledthefirstnumber3. Ofcourseitwasascammer—askedhertojoinaWebExsessionforhelp4. Hetookcontroland“showed”that87evilIPaddresseswereconnected5. SaidshecouldtakethePCtoa“CiscoStore”orpay$350foronlinehelp6. Askedhertocheckherbankdetailswhileconnectedandsherefused7. Thescammergotbelligerentandthreatening,andsheeventuallyhungup8. Theassociatewassounsettled,sheworriedshewasbeingwatched
CaseStudy:ScammerFiction,DoubleFeature
Thisinterviewwentreallywell!Wewereabletodosomethingsright:• Small,comfortableinterviewspace• Oneinterviewer,onescribe• Weabsolutelyneededdoublethetimewe’dbookedwithher• Lettingherspeakaboutherfeelings—she’dbeenterrifiedfordays,wasn’tsleeping• Wewereabletoexplainshe’dbeenscammedtwice,byunrelatedactors• Usereducationhelpedherunderstandwhatactuallyhappened,vs.thefrighteningliesthescammerhadtoldher
• Sheleftfeelingrelievedandempoweredtoresistfuturescams!
Questions?Thanksforattending!
Acknowledgements
• TheQuestionofQuestionTypesinPoliceInterviews:Areviewoftheliteraturefromapsychologicalandlinguisticperspective(2010:TheInternationalJournalofSpeech,Language,andtheLaw:Oxburg,Myklebust,andGrant)• InterviewingTechniquesinDomesticViolenceCases(NewJerseyDivisionofCriminalJustice)• #ISC2Congress:CybercrimeVictimsLeftDepressedandTraumatized
• https://www.infosecurity-magazine.com/news/isc2congress-cybercrime-victims/
• ALastingImpact:TheEmotionalTollofIdentityTheft• https://www.equifax.com/assets/PSOL/15-9814_psol_emotionalToll_wp.pdf