Who Put Holes in my Cheese: The Swiss Cheese Model of Root Cause Analysis

The most common root cause analysis seen in cases such as ransomware or business email compromise focuses mainly on the human aspect; a user clicked on a phishing link or opened a malicious document. From here, DFIR professionals close out the incident and move back into the day to day operations. This approach leaves a lot of unanswered questions; What vulnerabilities were exploited, was there a process breakdown, how did factors such as identify and access management and EDR bypass play into this incident? Answering these questions requires a dedicated methodology and model for incident responders to properly identify preexisting conditions and failures so that future incident can be presented. In this presentation, Gerard Johansen will be providing an overview of the Swiss Cheese Model of Root Cause Analysis. This model examines the various factors that aligned for an incident to occur. Instead of examining digital evidence for a single point of failure, this model looks at the entire chain of events, and identified how the holes in existing processes and configurations lead to the compromise. This talk will examine the following high level topics: Overview of the Swiss Cheese Model of Root Cause Analysis: To provide a solid background, this section will examine the rationale behind the Swiss Cheese Model and provide background on how the model can be used for incident root cause analysis. Active Failures vs. Latent Conditions: The two main components of the model examine how active failures, or failures due to human action or inaction can combine with latent conditions such as weak authentication mechanisms that align, allowing threat actors to exploit these components. Aligning Digital Forensics collection and analysis for root cause: There are a range of artifacts from malware analysis to full incident timelines that provide the best data for this type of root cause analysis. Additional focus will be on aligning this model with the overall incident response lifecycle. How to look at key data point and find the slices with holes so that process, people and technology controls can be better aligned to prevent similar incident in the future.