What are the key skills and tools for a security analyst to perform incident analysis and investigation?

In my opinion, as a skilled security analyst you need to have technical knowledge of many areas like Identity, Network, Threat Intel, Security Policies, etc. You may not be an expert in a particular area, but a clear understanding of the basics is going help as an investigator or responder. In my experience, I believe log analysis is one of the most important skills to have. Even before an incident is realized you need to understand the logs that your environment generates and should be able to identify a potential compromise. You can rely on tools (SIEM/xDR) to flag an incident. To better triage an incident, you have to delve into logs, or you want to develop custom detections for your environment understanding of the logs is crucial.

Drawing from my experience at White Internet, a security analyst must master both technical skills and intuitive judgment. Proficiency in network protocols, malware analysis, and tools like SIEM and EDR is foundational. However, equally vital is the analyst's ability to think like an attacker, predicting and preempting security breaches. This dual approach not only enhances incident analysis but also refines the investigation process, making it proactive rather than reactive. Developing these skills has significantly strengthened our security posture and incident response efficacy.

During an incident, your technical skills will come into play as you begin to investigate what has been affected. You will have to check your network's firmware or devices i.e., your firewalls, routers, switches, and wireless access points (WAP). For your WAP you want to make sure there are no rogue setups. Moreover, you will also need to check your application and file systems. This will be an involved team effort. However, there are tools that can help such as network analyzers. The main thing to do is observed the "order of volatility" and begin collecting data from sources such as RAM, Dom Controller, and any Endpoints. You can process this data through Forensic tools that will reveal entry points, hosts, and trace the malware's route.

A threat or an event is characterized by tactics, techniques, and procedures (TTPs). The MITRE ATT&CK table maps TTPs to commonly known patterns of attack and potential threat vectors. This information coupled with your detection system and SIEM will give you a starting point for your investigation. This is especially crucial if there are multiple points of entry and targets. Moreover, your analytical skills will kick in as soon as you start your investigation. Most often you will be forced to work against the clock completing task in parallel and prioritizing some tasks over others. Overall if done right, your critical, logical, and analytical thinking will possibly reduce your MTTR.

Critical and logical thought process, this skill is developed with experience of handling security incidents. A security analyst should be able to map the event of occurrences to draw a timeline for the incident which could answer the 5W & 1H (What, Who, Where, When, Why, How). This helps analysts to understand the Threat Actor, take appropriate containment, remediation actions. The ability to identify the root cause will help to improve the overall security posture of the organization with identification of gaps in security measures.

Using the analytical frameworks mentioned above, you also have to ask the right questions depending on the attack scenario and the entities involved in the attack.

If your technical skills are top notch and you could not communicate the findings and analysis to your audience, you would be doing injustice to your skill. A security analyst should have good communication skill to present their views to different audience. As a security analyst you may need to brief an incident to your leaders, or you may need to communicate the best practices to an end user. It is crucial to understand all pieces of incident and present it to your audience in a way that they would be able to absorb.

The incident response (IR) team will need to have strong formal and informal communication skills as they may need to communicate across departments, with leadership, service providers and even law enforcement. Leadership may also need the IR teams input when drafting a breach notice.

Collaboration is key when you are handling an incident. A security incident responder would need work with multiple parties. For example, an employee on notice period sends business confidential documents to personal email accounts would need to initiate Insider Threat Process, engage HR Team, Legal Team and Privacy team. Working with multiple teams can be sometimes overwhelming but not for an Incident Responder. For effective incident response it is essential to bring all relevant teams in the same page and manage the incident.

Collaboration is vital during an incident. Under your companies IR plan there will be a noted collaboration process. It will list what agencies and entities the incident response team will need to coordinate with. Moreover, if part of the team is remote collaboration applications may need to be setup according to your company's policies.

With evolving technology threat landscape is evolving rapidly. Threat actors spend their time and money to compromise or disturb your environment. It is rightly said “Threat Actors need to succeed once but a defender needs to succeed all the time”. A security analyst or responder need to up to date with the ever-changing technology, evolving weakness. So, it becomes apparent that you are learning continuously to improve your skills, be relevant and aware of the new technology and threat. Your learning helps you to defend yourself and your organization.

"You can't defend. You can't prevent. The only thing you can do is detect and respond." Bruce Schneier A determined adversary will find a way in. What seperates a minor and a major security incident is an organization's ability to detect respond and mitigate breach incidents as quickly as possible.