This guide has been developed with input from various partnering agencies and is part of a series of publications that highlight the critical need for cybersecurity measures on edge devices.
It is produced by the UK National Cyber Security Centre (NCSC) in collaboration with the Australian Signals Directorate (ASD), the US Cybersecurity and Infrastructure Security Agency (CISA), the Canadian Centre for Cyber Security (part of the Communications Security Establishment), the US Federal Bureau of Investigation (FBI), and New Zealand’s National Cyber Security Centre (NCSC-NZ).
Context for this guide
As threats from malicious actors evolve, the number of attacks targeting critical infrastructure continues to rise. Recent incidents have compromised both physical and virtual network devices, including perimeter security solutions and routers, as well as network-attached storage systems.
Network devices are valuable targets for attackers due to their essential role in traffic management and processing.
Attackers typically exploit vulnerabilities and unsecured design features to gain prolonged access, often remaining undetected within networks.
Factors that contribute to the vulnerability of these devices include the absence of secure design features, lack of regular firmware updates, weak authentication protocols, limited logging capabilities, incorrect configurations, inadequate network segmentation, and reliance on obsolete hardware.
Purpose and Audience of This Guide
This guide sets forth the minimum standards for forensic visibility designed to assist network defenders in securing their networks both before and after a compromise occurs. Network defenders are urged to consider these standards when choosing new physical and virtual network equipment.
Manufacturers are encouraged to incorporate and enable essential logging and forensic features as a default, ensuring that network defenders can swiftly detect suspicious activities and effectively respond to breaches.
Adhering to the minimum observability and digital forensics standards outlined in this guide will better equip manufacturers and their clients to identify and respond to malicious actions. Manufacturers should leverage this guidance to establish a foundation of essential features to be integrated into network devices to support forensic analysis.
Logging Requirements
Implementing the following features as baseline requirements can enhance threat detection and response capabilities for both physical and virtual network devices.
Devices and appliances should support the logging/recording of the following events:
-
authentication events, including usernames, methods used (such as password or multi-factor authentication), source IP addresses or hostnames, and relevant session identifiers for both successful and unsuccessful attempts.
-
technical support interactions that require authentication via vendor-specific license keys for accessing tools.
-
service and application-level logging, such as HTTP requests and responses, session control information, including client IP addresses, protocols used, and response statuses.
-
process creation details, encompassing parent processes, executable paths, usernames, and arguments.
-
process exit codes and reasons for termination, such as normal closure or unexpected crashes.
-
dynamic loading and unloading of modules/libraries, including names, file paths, related process IDs, and user context.
-
file system changes, including creation, modification, or deletion events, particularly in critical directories.
-
DNS queries for various record types and their associated details to facilitate investigations.
-
firmware or software update processes, documenting both successful and failed attempts along with relevant metadata.
-
configuration change logs, especially for devices exposed to the internet, capturing details of what was modified, by whom, and how.
-
backup or export activity related to device configurations.
-
any attempts to clear, rotate, or manipulate log files.
-
records of diagnostic or recovery-related events.
-
events related to peripheral device insertions such as USB devices.
Forensic Data Acquisition Requirements
Volatile Data Collection
Devices and appliances should facilitate the collection of volatile data through local or remote privileged interfaces. This process must trigger log generation to aid both automatic analysis and human investigators in identifying anomalous events.
While beneficial for defenders, be cautious as this data may also aid attackers. Implementing this feature securely is crucial.
When feasible, volatile data logging should support the gathering of:
-
process information including parent/child relationships and arguments.
-
process memory maps.
-
process-loaded modules along with their paths.
-
process handles related to both files and network sockets.
-
environment variables of processes.
-
memory utilization at both kernel and process levels.
-
firewall or packet processing rules.
-
mounted filesystems.
-
network connections, consisting of addresses, ports, and protocols.
-
current ARP table entries.
-
for network switches – CAM tables that link MAC addresses to specific ports.
-
DHCP lease tables detailing clients’ MAC addresses and allocated IPs.
-
active administrative and user sessions regardless of the interface in use.
-
kernel-loaded modules.
-
volatile filesystem contents such as temporary files hosted in /tmp.
-
raw volatile filesystems.
-
crash/core dumps.
-
comprehensive logs available from a system and application perspective.
Should redaction be necessary to protect intellectual property or security during volatile data collection, it’s vital to clearly mark any sensitive information as *REDACTED* within the logs and document this appropriately.
Non-volatile Data Collection
Devices and appliances should support complete non-volatile storage collection capabilities, ideally through standardized interfaces. System owners must be able to decrypt stored data, which may require support from the vendor, to conduct thorough inspections.
Initial configurations may be necessary to enable this capability, such as ‘bring your own key’. Ensuring key protection and incorporating safeguards in the device’s firmware and hardware against unauthorized data extraction are paramount.
All interfaces used for non-volatile collection must enforce robust authentication and authorization protocols to mitigate the risks of misuse.
Additional Resources
Based on an article from ncsc.gov.uk: https://www.ncsc.gov.uk/guidance/guidance-on-digital-forensics-protective-monitoring
