Forensics in a Zero Trust world
Jul 2nd, 2019 by Jesper Kråkhede
Computer forensics used to be quite straight forward. Find the computer, take an image of the disk, follow the traces and figure out what the person did.
With Zero Trust the computer is no longer the centre of the investigation. The identity is. Every access is verified and logged, so we have a lot more traces of what an identity did, where it logged on from, from which device and to which data. That is the good news.
The bad news is that the question has changed. It is no longer enough to show that the account of Mr X downloaded the customer register. Any defence lawyer worth his salary will ask: ‘How do you know it was Mr X?’ And to be frank, with token theft, phishing kits that bypass MFA and hijacked sessions, that is a very fair question.
So the focus shifts. Instead of only reconstructing what was done we must prove who actually did it. Did the logon come from a device we know he uses? Did the location make sense, or was he in Stockholm and Singapore within the same hour? Was the session token suddenly used from a new IP address? Was a new phone registered for MFA the day before?
Finding the traces of an identity takeover is the new disk image. If you can´t exclude that the identity was compromised you can´t really say that the person did it.
Logged on is not the same as guilty.