Thread by @chrissanders88

Abstractions are something analysts have to deal with in lots of forms. Abstraction is the process of taking away characteristics of something to represent it more simply. So, what does that looks like? 1/

Well, speaking broadly, let's say that I tell you I had scrambled eggs with parsley and tarragon for breakfast. You can probably picture that very clearly in your mind and it will be fairly accurate to reality. However... 2/

What if I just tell you I just had eggs? Or that I just had breakfast? Your perception of reality may differ greatly from what I actually ate. The abstraction increases opportunity for error.

3/

Opportunity for error is the key phrase here.

Let's consider some analyst-relevant examples related to abstraction...

4/

Consider examining a log of a user account changing some firewall rules. You look up the human associated with the account and it's someone in IT. That's expected behavior for that role, so you dismiss it.

However...

5/

An account is an abstracted representation of a human user. Just because it represents the human does not mean that they always control it. The abstraction creates an assumption.

6/

In another example, consider examining the behavior of an individual host that you identify by its IP address. All of a sudden, the host starts behaving completely differently without a clear cause. Suspicious, right?

However...

7/

It turns out the original host lost its DHCP lease during the time of your query. You've actually changed the host you're looking at without realizing it. The IP address represents an abstraction from a host that is subject to change. Abstractions can mask changes.

8/

But alas, abstractions aren't universally bad! Consider my research on opening move impact on speed in an investigation. In the same scenario, analysts who had Zeek/Bro data reached a conclusion much faster than those with only PCAP.

Source: chrissanders.org/2016/09/effect…

9/

Zeek is abstracted from PCAP. We don't always need data in its rawest form to make conclusions, and sometimes, all that extra data can significantly slow us down.

10/

We make abstractions in our minds all the time. They are shortcuts, and they are useful. But, if we don't understand the abstraction we might trick ourselves into serious mistakes.

11/

This is another area where I frequently observe a gap between novice and expert analysts. Experts fall victim to abstractions less often because they are aware of them and what they mean. Novices have to learn this, and sometimes do it the hard way.

12/

Some key questions to ask are:

1. Is this representation abstracted from something?

2. What is it abstracted from?

3. How does the source translate to the abstraction?

4. What assumptions do I make when making decisions from the abstraction?

13/

Abstractions are everywhere in digital evidence, and all told, they're a net positive. But, they present the opportunity for error. The path to expertise includes the awareness of such abstractions to prevent the errors frequently associated with them.

14/14