Hodisalarga Javob Berish

Incident Response — kiberhujumga tizimli javob berish jarayoni

Kiberxavfsizlik sohasida "hujumga uchrash emas, balki qachon uchrash" degan ibora bor. Incident Response (IR) — xavfsizlik hodisasini aniqlash, o'z ichiga olish, bartaraf etish va undan tiklanish uchun tizimli yondashuv. Yaxshi IR jamoasi breach narxini o'rtacha $1.76 millionga kamaytiradi.

$4.45M

O'rtacha breach narxi

207 kun

O'rtacha aniqlash vaqti

73 kun

Bartaraf etish vaqti

200 kun

IR bilan tejash: 200 kun

NIST IR Sikli — 4 Bosqich

Bosqich 1: Tayyorgarlik (Preparation)

Yaxshi tayyorgarlik IR samaradorligini belgilaydi. Hujum kelmasdan oldin jarayon, jamoa va asboblar tayyor bo'lishi kerak.

Incident Response Rejasi (IRP):

1 Hodisa turlari va darajalari (P1-P5) aniqlash
2 Xabardor qilish zanjiri (Escalation matrix)
3 Aloqa kanallari va backup usullari
4 Har hodisa turi uchun Playbook
5 Muntazam mashg'ulot va simulyatsiya (Tabletop)

CSIRT — Computer Security Incident Response Team:

IR Lead / Manager Koordinatsiya

Forensic Analyst Dalil yig'ish

Malware Analyst Tahdid tahlili

Network Analyst Trafik tahlili

Legal / PR Qonuniy masalalar

Bosqich 2: Aniqlash va Tahlil

Hodisani Tasniflash (Severity Levels):

P1

Critical

Ishlab chiqarish tizimi to'xtagan, ma'lumot sizib chiqmoqda. Darhol javob!

P2

High

Muhim tizim ta'sirlangan, zararli faoliyat aniqlangan. 1 soat ichida javob.

P3

Medium

Nozik bo'lmagan tizim ta'sirlangan. 4 soat ichida javob.

P4

Low

Kichik ta'sir, odd behavior. Keyingi ish kuni ichida.

Digital Forensik Asboblar:

Volatility — RAM tahlili

volatility -f memory.dump --profile=Win10x64 pslist
volatility -f memory.dump --profile=Win10x64 netscan
volatility -f memory.dump --profile=Win10x64 malfind

Autopsy / FTK — Disk tahlili

Fayl tizimi tahlili, silangan fayllarni tiklash, artifact olish

Wireshark — Trafik tahlili

# C2 aloqani aniqlash
ip.dst == 185.220.101.0/24
# DNS tunneling
dns and frame.len > 200

Forensik Asosiy Qoidalar:

1. Avval ma'lumot yig'ing, keyin o'chiring

2. Disk imajini nusxa olishdan oldin yozing

3. Hash (SHA256) bilan dalil butunligini tasdiqlang

4. Hamma amallarni journal'ga yozing (Chain of Custody)

5. Asl dalilni asling (working copy dan ishlang)

6. Volatility order: RAM → Swap → Disk

Bosqich 3: Izolyatsiya, Bartaraf va O'chirish

Short-term Containment

Darhol tarqalishni to'xtating. Zararni minimal qiling.

• Zararli tizimni izolyatsiya qiling
• Zararli akkauntlarni bloklang
• Qo'shimcha monitoring yoqing
• RAM va log larni saqlang

Long-term Containment

Biznes davom etishi uchun vaqtinchalik yechim.

• Backup sistemalarni ishga tushiring
• Patch yoki workaround
• Monitoring kuchaytirish
• ACL qoidalarini yangilash

Eradication

Tahdidni butunlay yo'q qilish.

• Malware ni o'chirish
• Backdoorlarni yopish
• Zaif dasturlarni yangilash
• Konfiguratsiyani tiklash

Windows Hodisa Tahlili — Asosiy Buyruqlar:

# Ishlaydigan jarayonlar
tasklist /v
Get-Process | Sort-Object CPU -Descending | Select -First 20

# Tarmoq ulanishlar
netstat -ano
Get-NetTCPConnection | Where-Object State -eq Established

# Scheduled tasks (persistence)
schtasks /query /fo LIST /v
Get-ScheduledTask | Where-Object State -ne Disabled

# Autorun joylar
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

# Event log — login failures
Get-WinEvent -LogName Security | Where-Object Id -eq 4625 | Select -First 20

# Fayllarni hash qilish
Get-FileHash C:\Windows\System32\*.exe | Export-Csv hashes.csv

Bosqich 4: Tiklanish va Post-Incident

Tizimni Tiklash Bosqichlari:

1

Clean backup dan tiklash

Hujumdan oldingi ma'lum-yaxshi holatga qaytish

2

Patch va hardening

Kirib kelgan zaiflikni yopish, konfiguratsiyani mustahkamlash

3

Parollarni yangilash

Ta'sirlangan barcha akkauntlar paroli o'zgartiriladi

4

Monitoring kuchaytirish

Qayta hujum belgilari uchun kuzatuv kuchaytiriladi

5

Tizimni ishga qaytarish

Tekshirishdan so'ng production'ga qaytish

Post-Incident Review (Lessons Learned):

Majburiy savollar:

Nima sodir bo'ldi? (Timeline)
Qanday aniqlandik? (yoki aniqlanmadik)
Javobimiz qanchalik samarali edi?
Nima to'g'ri bajarildi?
Nima yaxshilanishi kerak?
Kimga xabar berilishi kerak edi?
Qanday boshlanmang jarayonlar bor?

Qonuniy Majburiyatlar (Data Breach Notification):

EU GDPR — 72 soat ichida DPA ga xabar
US HIPAA — 60 kun ichida (tibbiy ma'lumot)
UZ O'zbekiston — CERT.UZ ga xabar berish

Mashhur Hodisalar va IR Saboqlari

Target Breach (2013)

40 million karta ma'lumoti o'g'irlandi. $162M zarar.

Sabab: HVAC vendor credentials orqali kirish

Sabaq: Third-party access nazorat, network segmentation

Equifax Breach (2017)

147 million kishi ma'lumoti. $575M settlement.

Sabab: Apache Struts zaiflik (CVE-2017-5638) patch qilinmagan

Sabaq: Vulnerability management, patch management jarayoni

NotPetya (2017)

$10 milliard zarar. Maersk, Merck, FedEx ta'sirlandi.

Sabab: Ukraine muhasabat dasturi zaiflik + EternalBlue

Sabaq: Network segmentation, backup (offline), patch tezligi

Colonial Pipeline (2021)

$4.4M to'lov. AQSh sharqida 6 kun yoqilg'i taqchilligi.

Sabab: Eski VPN parol dark web'da edi (MFA yo'q)

Sabaq: MFA majburiy, legacy systems xavfsizligi, IR plani

IR Asboblari va Platformalari

SOAR Platformalari

• Splunk SOAR (Phantom)
• Palo Alto XSOAR
• IBM SOAR
• TheHive (Open Source)

Security Orchestration, Automation and Response

Forensik Asboblar

• Autopsy / FTK — Disk tahlili
• Volatility — RAM tahlili
• Wireshark — Trafik
• Velociraptor — EDR/IR
• KAPE — Artifact yig'ish

Malware Tahlili

• VirusTotal — Multi-AV skan
• Any.run — Dynamic sandbox
• Cuckoo Sandbox — OSS sandbox
• Ghidra/IDA Pro — Reverse Eng
• FLOSS — String extraction

Bilimingizni Sinang

1. NIST IR metodologiyasining to'g'ri ketma-ketligi qaysi?

A) Aniqlash → Tayyorgarlik → Izolyatsiya → Tiklanish
B) Tayyorgarlik → Aniqlash → Izolyatsiya → Tiklanish — NIST IR lifecycle
C) Izolyatsiya → Tayyorgarlik → Tiklanish → Aniqlash
D) Tiklanish → Aniqlash → Tayyorgarlik → Izolyatsiya

2. Forensik dalil yig'ishda qaysi tartib to'g'ri?

A) Disk → Swap → RAM
B) RAM → Swap → Disk — Volatility order, RAM birinchi saqlana
C) Swap → RAM → Disk
D) Har qanday tartibda bo'ladi

3. GDPR bo'yicha ma'lumotlar buzilishi haqida qancha vaqt ichida xabar berish shart?

A) 24 soat
B) 72 soat — Supervisory authority (DPA) ga xabar berish muddati
C) 7 kun
D) 30 kun

Tabriklaymiz!

Siz kiberxavfsizlikning barcha asosiy mavzularini muvaffaqiyatli o'zdingiz!

Tarmoq Xavfsizligi

OSI model, TCP/IP, Firewalls, IDS/IPS

Hujum Turlari

Web, WiFi, Social Engineering, DDoS

Himoya va IR

SOC, SIEM, Pentest, Forensics

CTF Musobaqalariga o'tish Boshidan o'qish