Digital Forensics. Module 9 CS 996
|
|
|
- Jeffery Stanley
- 6 years ago
- Views:
Transcription
1 Digital Forensics Module 9 CS 996
2 Outline of Module #9 Presentation on Achilles Discussion of forensic topics in the news Windows host forensics and Windows forensic tools Network forensic tools and methods 4/13/2005 Module 9 2
3 New PayPal Scam Fraudsters now advertising anti-fraud measures! Outstanding social engineering The virtual confidence game 4/13/2005 Module 9 3
4 Avoiding Adverse Rulings in Forensic Discovery! Laura Zubulake case and many others Have an incident response plan in place!! 4/13/2005 Module 9 4
5 Zubulake Case Employment discrimination: Zubulake v. UBS discovery issues and rulings Court ruled that defendant had to pay for discovery Lost and deleted UBS s Court granted adverse inference jury instruction April 7, 2005: jury ruling against UBS $20.1M punitive damages $9.1M compensatory damages 4/13/2005 Module 9 5
6 Phen-Fen Diet Pill Case Settled in 2002 by American Home Products Surprise from CEO: Do I have to look forward to spending my waning years writing checks to fat people worried about a silly lung problem Settlement: $4.75B 4/13/2005 Module 9 6
7 Eight Steps to Avoid Jail Written plan of attack Potential data locations People involved Forensic tools Prioritize the data People Information collected Conduct thorough interviews with IT Don t ignore any data locations or file types 4/13/2005 Module 9 7
8 Eight Steps, continued Don t allow individual users to collect the data Metadata Commercial software vs. forensic tools Know when to image drive vs. copying Don t limit names in searches freds, fscholl, etc. Maintain chain of custody 4/13/2005 Module 9 8
9 New Federal Rules for Digital Evidence (In Preparation) What s a document? Digital information Active data Replicant data Archival data Residual data (deleted) Embedded data (metadata) Astronomical Costs! Restoration: $850K-$4M Privilege review: $16-$70M 4/13/2005 Module 9 9
10 Federal Rules of Evidence for Log Files Admissibility vs. weight of evidence Hearsay (business record exception) Authentication Altered, manipulated Program reliability 4/13/2005 Module 9 10
11 Investigating Windows Systems Basic Application log files Temp files Recently used documents Recycle bin History + temporary Internet files Registry Hidden Files ADS.chk files (fragments from Windows crashes) Swap space 4/13/2005 Module 9 11
12 Windows Log Files Stored in %systemroot%\system32\config sysevent.evt secevent.evt appevent.evt No centralized log file hosting built in Kiwi syslog for windows EventReporter Logs are binary! 4/13/2005 Module 9 12
13 Logging: Setting Audit Policy 4/13/2005 Module 9 13
14 Microsoft Recommended Settings Audit account logons Audit account management Audit logons Success on domain controllers Success Success Audit object access If required 4/13/2005 Module 9 14
15 Recommended Settings, cont. Audit policy changes Audit privilege use Success on domain controllers If required Audit system events Success or failure Enable process tracking If required Audit Directory Service access If required 4/13/2005 Module 9 15
16 Analyzing Windows Logs 4/13/2005 Module 9 16
17 Registry Settings: Event Logging 4/13/2005 Module 9 17
18 Windows Investigation (Before Looking for Deleted Files!) Check application logs C:\winnt\system32\config\appevent.evt Recently used documents C:\Documents and Settings\User\Recent Contains shortcuts to recently used files Programs from start > run menu HKEY_CURRENT_USER\software\microsoft\ windows\current version\explorer\runmru 4/13/2005 Module 9 18
19 More Windows Investigation Windows Temp Files C:\WINNT\Temp C:\Documents and Settings\User\Local Settings\Temp Find {Files, Computers, Text} Dialog Box HKEY_CURRENT_USER\software\microsoft\ Internet explorer\explorer bars\id\ Files Names MRU ComputerNamedMRU ContainingTextMRU 4/13/2005 Module 9 19
20 Windows Search Functions: Type 4/13/2005 Module 9 20
21 Investigative Searching Create private information by analysis multiple sources of public information Google hacks 4/13/2005 Module 9 21
22 Copernic Search Tools Desktop Search: free Agent Web search Aggregates 90 search engines $0-$79.95 Flexible options 4/13/2005 Module 9 22
23 Copernic Options 4/13/2005 Module 9 23
24 Copernic Image Search 4/13/2005 Module 9 24
25 FORENSIC SOURCES OF INFORMATION ROUTER SYSLOG FILES SERVER LOG FILES FIREWALL LOG FILES IP INVESTIGATIONS INTERNET ARCHIVES ISP RECORDS HARD DRIVE REGISTRY & CONTENT LIVE SNIFFER DATA COLLECTION 4/13/2005 Module 9 25
26 Network Sniffers Wildpackets Etherpeek: network engineers Eeye IRIS: user friendly Ethereal: free! Kismet (Linux): wireless and free! CommView ( CommView for WiFi 4/13/2005 Module 9 26
27 CommView Remote Agent 4/13/2005 Module 9 27
28 Operation of Remote Agent RA captures packets and sends to CommView Filter configuration sent from CommView to RA RA accessed using challenge response protocol using SHA-1 hash All subsequent traffic between RA and Commview is compressed and encrypted Use CAST with 128 bit key 4/13/2005 Module 9 28
29 USE OF COMMVIEW REMOTE AGENT COMMVIEW RA DIAL-UP WIRELESS RA BB RA 4/13/2005 Module 9 29
30 Acquiring web sites Teleport Pro 10 threads, 65,000 URL s $39.95 Teleport VLX 40 million URL s $1995 Teleport Exec Developer tool: CIA, USDOJ, etc. $2495 4/13/2005 Module 9 30
31 Teleport Pro 4/13/2005 Module 9 31
32 SIM Tools: Why Event Logging? Security Information Management One critical part of security infrastructure Prevention Detection Response Regulatory requirements Medical: HIPAA Financial: GLB 4/13/2005 Module 9 32
33 Event Logging Syslogd in Unix Configure /etc/syslog.conf Message format: time stamp/hostname/application specific body No standard for fields Focus on infrastructure systems Mailservers, web server, routers, etc. Create centralized loghost 4/13/2005 Module 9 33
34 HIPAA Logging Requirements Administrative Safeguards (a) (1) Security Management Process Information system activity review (Required) (a) (5) Security Awareness and Training Log-in monitoring (Addressable) (a) (6) Security Incident Procedures Identify and respond to suspected or known security incidents; document security incidents and their outcomes (Required) Technical Safeguards (b) Audit controls to record and examine activity in systems that contain or use electronic PHI 4/13/2005 Module 9 34
35 HIPAA Security Update Health Insurance Portability and Accountability Act Security Rule Deadline: April 21, 2005 Reference: NIST Special Publication Administrative Safeguards Physical Safeguards Technical Safeguards Organizational Safeguards Policies/Procedures/Documentation 4/13/2005 Module 9 35
36 Gramm Leach Bliley (GLB) FFIEC Handbook (Federal Financial Institutions Examination Council) Control access to applications by logging access and security events Secure access to the OS of all system components by logging and monitoring user or program access to sensitive resources and alerting on security events 4/13/2005 Module 9 36
37 MANAGEMENT STATION AGGREGATOR AGGREGATOR ARCHIVE STORAGE ROUTER SWITCH HUB FIREWALL/IDS END USER SECURITY INFORMATION MANAGEMENT END USER SYSLOG DATA HOST 4/13/2005 Module 9 37
38 Syslog Protocol RFC 3164 COLLECTOR DEVICE RELAY Uses UDP port 514 Message format Priority field: 0-7 Header field: host name and time stamp Message field: ASCII characters describing event 4/13/2005 Module 9 38
39 Syslog Priority Levels SEVERITY TYPE Emergencies Alerts Critical Errors Warnings Notifications Informational Debugging DESCRIPTION System unusable Immediate action Critical condition Error messages Warning message Normal Information Debug message 4/13/2005 Module 9 39
40 Configuring Syslog on Linux Host 4/13/2005 Module 9 40
41 Syslog Message Structure 4/13/2005 Module 9 41
42 Linux Log Files 4/13/2005 Module 9 42
43 Limitations of Syslog UDP not reliable No authentication or encryption RFC 3195: reliable syslog draft-ietf-syslog-sign-14.txt: signed syslog Relay function omits original IP address 4/13/2005 Module 9 43
44 Security Information Vendors Function Visualize Information Correlate Information Data Aggregation/ Analysis Data Collection/Analysis Vendor Secure Decisions Intellitactics, NetForensics, ArcSight, GuardedNet, Open Services Network Intelligence, Forensics Explorers LogLogic, Addamark, Niksun Sandstorm 4/13/2005 Module 9 44
45 Network Traffic Recorders Record all traffic on network Niksun NetDetector Sandstorm NetIntercept 4/13/2005 Module 9 45
46 NetForensics Architecture ROUTER AGENTS ORACLE DATABASE IDS NF ENGINE: EVENT AGGREGATION AND CORRELATION HOST FIREWALL REPORTING TOOL: REAL TIME ANALYSIS; FORENSIC REPORTS 4/13/2005 Module 9 46
47 Event Correlation Rules based: If then else Statistical: monitor changes in event statistics Behavioral: monitor trends in security events 4/13/2005 Module 9 47
48 Intellitactics Message Architecture SYSLOG MESSAGE: DATE, TIME STAMP, SOURCE, DESTINATION, EVENT CODE (CISCO PIX DENY INBOUND TCP CONNECTION) CREATE NORMALIZED TYPE FIELD BASED ON EVENT TYPE ADD ZONE FIELDS BASED ON SOURCE LOCATION, TARGET LOCATION AND FIREWALL LOCATION ADD PRIORITY FIELD: TYPE FIELD + ASSET CLASSIFICATION 4/13/2005 Module 9 48
49 Log Logic Log Appliance Archiving of log file data Uses intelligent data compression technique Allows real time and historical threat analysis Cisco message ID Message volume Regular expression filter LX-1000 Up to 1000 messages/second 90 GB storage: 90 days storage Archive server: 2 TB and 2 years of data 4/13/2005 Module 9 49
50 LogLogic Log Appliance WWW, SMTP SYSLOG & PROPRIETARY MESSAGES FIREWALL CHECK POINT NETSCREEN CISCO PIX LOG APPLIANCE STRIPPED-DOWN LINUX OS MYSQL DATABASE ARCHIVE SERVER 4/13/2005 Module 9 50
51 Summarization of Log Files TCP CONNECTIONS PER WEB PAGE PIX FIREWALL PC USER SYSLOG MESSASGES WWW SERVER TAKES MESSAGES AND SUMMARIZES TO ONE DATABASE RECORD LOGLOGIC LOGAPPLIANCE 4/13/2005 Module 9 51
52 Applications of Log File Forensics Help diagnose virus infections Analysis of time zero events Monitor inside traffic for infected machines Help analyze hacker events Set log alerts to catch breaches in real time 4/13/2005 Module 9 52
53 Log File Formats CheckPoint Proprietary binary format, not human readable Time Action Firewall Interface Product Source Source Port Dest. Service Protocol Translation (NAT) Cisco PIX Syslog format Date Time IP/Hostname Message Code Message NetScreen Syslog format Date Time Module Severity Type Message Text 4/13/2005 Module 9 53
54 Significance of Priority Levels SEVERITY TYPES FUNCTION Alert, Critical, Error, Warning Notifications Informational Debug Packet anomalies, policy conflicts Work done on the firewall Key to performing audit and policy verification Resolve firewall operational issues 4/13/2005 Module 9 54
55 Example PIX Syslog Messages Severity Cisco # Description 0 Not used No response from other firewall Deny inbound UDP from A.B.C.D/Port to L.M.N.O/Port 4/13/2005 Module 9 55
56 Example Syslog Messages, cont. Severity Cisco # Description Deny inbound from outside: IP_addr to inside: IP_addr IP fragment malformed; total size exceeds 65,535 bytes User logged out 4/13/2005 Module 9 56
57 Example Syslog Messages, cont. Level Cisco # Description Start PIX firewall User executed command string that does not alter configuration 4/13/2005 Module 9 57
58 Severity Messages Contain critical information about traffic in/out of network %PIX : user Accessed URL : %PIX : Built TCP connection number for interface_name: real_address/real_port to interface_name:real_address/real_port 4/13/2005 Module 9 58
59 4/13/2005 Module 9 59
60 Real Time Reporting 4/13/2005 Module 9 60
61 LogApp Configure Alerts 4/13/2005 Module 9 61
62 4/13/2005 Module 9 62
63 4/13/2005 Module 9 63
64 4/13/2005 Module 9 64
65 4/13/2005 Module 9 65
66 4/13/2005 Module 9 66
67 References Computer Records and the Federal Rules of Evidence, /13/2005 Module 9 67
Digital Forensics. Module 8 CS 996
Digital Forensics Module 8 CS 996 Outline of Module #8 Presentation on hping Discussion of important forensic cases Windows host forensics and Windows forensic tools Network forensic tools and methods
Cisco Security Monitoring, Analysis and Response System 4.2
Q&A Cisco Security Monitoring, Analysis and Response System 4.2 GENERAL Q. What is the Cisco Security Monitoring, Analysis and Response System? A. The Cisco Security Monitoring, Analysis and Response System
CCISO Blueprint v1. EC-Council
CCISO Blueprint v1 EC-Council Categories Topics Covered Weightage 1. Governance (Policy, Legal, & Compliance) & Risk Management 1.1 Define, implement, manage and maintain an information security governance
EC-Council Certified Network Defender (CND) Duration: 5 Days Method: Instructor-Led
EC-Council Certified Network Defender (CND) Duration: 5 Days Method: Instructor-Led Certification: Certified Network Defender Exam: 312-38 Course Description This course is a vendor-neutral, hands-on,
Network Security: Firewall, VPN, IDS/IPS, SIEM
Security: Firewall, VPN, IDS/IPS, SIEM Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr What is a Firewall? A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
ISO27001 Preparing your business with Snare
WHITEPAPER Complying with ISO27001 Preparing your business with Snare T he technical controls imposed by ISO (International Organisation for Standardization) Standard 27001 cover a wide range of security
Top 10 use cases of HP ArcSight Logger
Top 10 use cases of HP ArcSight Logger Sridhar Karnam @Sri747 Karnam@hp.com #HPSecure Big data is driving innovation The Big Data will continue to expand Collect Big Data for analytics Store Big Data for
Applied IT Security. System Security. Dr. Stephan Spitz 6 Firewalls & IDS. Applied IT Security, Dr.
Applied IT Security System Security Dr. Stephan Spitz Stephan.Spitz@de.gi-de.com Overview & Basics System Security Network Protocols and the Internet Operating Systems and Applications Operating System
CRYPTTECH. Cost-effective log management for security and forensic analysis, ensuring compliance with mandates and storage regulations
Cost-effective log management for security and forensic analysis, ensuring compliance with mandates and storage regulations Integration with Numerous Type of Devices Flexible Architectural Configuration
Securing Information Systems
Chapter 7 Securing Information Systems 7.1 2007 by Prentice Hall STUDENT OBJECTIVES Analyze why information systems need special protection from destruction, error, and abuse. Assess the business value
Computer Network Vulnerabilities
Computer Network Vulnerabilities Objectives Explain how routers are used to protect networks Describe firewall technology Describe intrusion detection systems Describe honeypots Routers Routers are like
2. INTRUDER DETECTION SYSTEMS
1. INTRODUCTION It is apparent that information technology is the backbone of many organizations, small or big. Since they depend on information technology to drive their business forward, issues regarding
Overview Intrusion Detection Systems and Practices
Overview Intrusion Detection Systems and Practices Chapter 13 Lecturer: Pei-yih Ting Intrusion Detection Concepts Dealing with Intruders Detecting Intruders Principles of Intrusions and IDS The IDS Taxonomy
GuardTower TM White Paper. Enterprise Security Management Systems
GuardTower TM White Paper Enterprise Security Management Systems 2 1 Table of Contents 1 Table of Contents... 2 2 Introduction... 3 3 Enterprise Security Management Systems... 3 3.1 ESMS Architectures...
Cybersecurity Conference Presentation North Bay Business Journal. September 27, 2016
Cybersecurity Conference Presentation North Bay Business Journal September 27, 2016 1 PRESENTER Francis Tam, CPA, CISM, CISA, CITP, CRISC, PCI QSA Partner Information Security and Infrastructure Practice
Unit 4: Firewalls (I)
Unit 4: Firewalls (I) What is a firewall? Types of firewalls Packet Filtering Statefull Application and Circuit Proxy Firewall services and limitations Writing firewall rules Example 1 Example 2 What is
Digital Forensics. Module 6 CS 996
Digital Forensics Module 6 CS 996 Module #5 Covered B of A case; corporate responsibility for security New security standards: NIST 800-53 and ITIL Another new security standard: ISF Standard of Good Practice
716 West Ave Austin, TX USA
Fundamentals of Computer and Internet Fraud GLOBAL Headquarters the gregor building 716 West Ave Austin, TX 78701-2727 USA TABLE OF CONTENTS I. INTRODUCTION What Is Computer Crime?... 2 Computer Fraud
Security Information Managers: State of the Art. Joel M Snyder Senior Partner Opus One
Security Information Managers: State of the Art Joel M Snyder Senior Partner Opus One jms@opus1.com Definition: SIMs accept security information from multiple sources within the enterprise and analyze
Request for Proposal (RFP) for Supply and Implementation of Firewall for Internet Access (RFP Ref )
Appendix 1 1st Tier Firewall The Solution shall be rack-mountable into standard 19-inch (482.6-mm) EIA rack. The firewall shall minimally support the following technologies and features: (a) Stateful inspection;
Cybersecurity Auditing in an Unsecure World
About This Course Cybersecurity Auditing in an Unsecure World Course Description $5.4 million that s the average cost of a data breach to a U.S.-based company. It s no surprise, then, that cybersecurity
CounterACT Syslog Plugin
Version 3.2.0 Table of Contents About the Syslog Plugin... 3 Multiple Destination Syslog Server Support... 3 Receiving Event Messages... 3 Sending Syslog Messages... 4 Sending CounterACT Event Messages...
Security Audit What Why
What A systematic, measurable technical assessment of how the organization's security policy is employed at a specific site Physical configuration, environment, software, information handling processes,
Required Textbook and Materials. Course Objectives. Course Outline
Information Technology Security (ITSY 1342) Credit: 3 semester credit hours (2 hours lecture, 4 hours lab) Prerequisite/Co-requisite: None Course Description Instruction in security for network hardware,
Hacker Academy Ltd COURSES CATALOGUE. Hacker Academy Ltd. LONDON UK
Hacker Academy Ltd COURSES CATALOGUE Hacker Academy Ltd. LONDON UK TABLE OF CONTENTS Basic Level Courses... 3 1. Information Security Awareness for End Users... 3 2. Information Security Awareness for
CSC Network Security
CSC 474 -- Security Topic 9. Firewalls CSC 474 Dr. Peng Ning 1 Outline Overview of Firewalls Filtering Firewalls Proxy Servers CSC 474 Dr. Peng Ning 2 Overview of Firewalls CSC 474 Dr. Peng Ning 3 1 Internet
Digital Forensics. Module 7 CS 996
Digital Forensics Module 7 CS 996 Module #6 Covered Using Autopsy Using Helix 3/30/2005 Module 7 2 Outline of Module #7 Review mid-term Helix presentation Forensic business news Gates v. Bando case Linux
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Virus Outbreak
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
Designing and Building a Cybersecurity Program
Designing and Building a Cybersecurity Program Based on the NIST Cybersecurity Framework (CSF) Larry Wilson lwilson@umassp.edu ISACA Breakfast Meeting January, 2016 Designing & Building a Cybersecurity
Preparing for a Breach October 14, 2016
Preparing for a Breach October 14, 2016 Jeremy Gilbert, GCFE, GASF, EnCE, CPA Manager, DHG Forensics forensics 1 Agenda Medical data breaches Why? Types? Frequency? Impact of a data breach How to prepare
Information Security in Corporation
Information Security in Corporation System Vulnerability and Abuse Software Vulnerability Commercial software contains flaws that create security vulnerabilities. Hidden bugs (program code defects) Zero
Syllabus: The syllabus is broadly structured as follows:
Syllabus: The syllabus is broadly structured as follows: SR. NO. TOPICS SUBTOPICS 1 Foundations of Network Security Principles of Network Security Network Security Terminologies Network Security and Data
Forescout. Configuration Guide. Version 3.5
Forescout Version 3.5 Contact Information Forescout Technologies, Inc. 190 West Tasman Drive San Jose, CA 95134 USA https://www.forescout.com/support/ Toll-Free (US): 1.866.377.8771 Tel (Intl): 1.408.213.3191
Subscriber Data Correlation
Subscriber Data Correlation Application of Cisco Stealthwatch to Service Provider mobility environment Introduction With the prevalence of smart mobile devices and the increase of application usage, Service
Introduction to Network Discovery and Identity
The following topics provide an introduction to network discovery and identity policies and data: Host, Application, and User Detection, page 1 Uses for Host, Application, and User Discovery and Identity
Balancing Compliance and Operational Security Demands. Nov 2015 Steve Winterfeld
Balancing Compliance and Operational Security Demands Nov 2015 Steve Winterfeld What is more important? Compliance with laws / regulations Following industry best practices Developing a operational practice
Introduction to Network Discovery and Identity
The following topics provide an introduction to network discovery and identity policies and data: Host, Application, and User Detection, on page 1 Uses for Host, Application, and User Discovery and Identity
University of Pittsburgh Security Assessment Questionnaire (v1.7)
Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.7) Directions and Instructions for completing this assessment The answers provided
Cybersecurity What Companies are Doing & How to Evaluate. Miguel Romero - NAIC David Gunkel & Dan Ford Rook Security
Cybersecurity What Companies are Doing & How to Evaluate Miguel Romero - NAIC David Gunkel & Dan Ford Rook Security Learning Objectives At the end of this presentation, you will be able to: Explain the
Design your network to aid forensics investigation
18th Annual FIRST Conference Design your network to aid forensics investigation Robert B. Sisk, PhD, CISSP Senior Technical Staff Member IBM Baltimore, Maryland USA Master Outline Introduction Incident
Spring 2010 CS419. Computer Security. Vinod Ganapathy Lecture 14. Chapters 6 and 9 Intrusion Detection and Prevention
Spring 2010 CS419 Computer Security Vinod Ganapathy Lecture 14 Chapters 6 and 9 Intrusion Detection and Prevention Firewalls and IPSes effective means of protecting LANs internet connectivity essential
firewalls perimeter firewall systems firewalls security gateways secure Internet gateways
Firewalls 1 Overview In old days, brick walls (called firewalls ) built between buildings to prevent fire spreading from building to another Today, when private network (i.e., intranet) connected to public
Mapping BeyondTrust Solutions to
TECH BRIEF Taking a Preventive Care Approach to Healthcare IT Security Table of Contents Table of Contents... 2 Taking a Preventive Care Approach to Healthcare IT Security... 3 Improvements to be Made
Carbon Black PCI Compliance Mapping Checklist
Carbon Black PCI Compliance Mapping Checklist The following table identifies selected PCI 3.0 requirements, the test definition per the PCI validation plan and how Carbon Black Enterprise Protection and
Chapter 7 Forensic Duplication
Chapter 7 Forensic Duplication Ed Crowley Spring 11 Topics Response Strategies Forensic Duplicates and Evidence Federal Rules of Evidence What is a Forensic Duplicate? Hard Drive Development Forensic Tool
TRUSTED IT: REDEFINE SOCIAL, MOBILE & CLOUD INFRASTRUCTURE. John McDonald
TRUSTED IT: REDEFINE SOCIAL, MOBILE & CLOUD INFRASTRUCTURE John McDonald 1 What is Trust? Can I trust that my assets will be available when I need them? Availability Critical Assets Security Can I trust
Configuring Logging. Information About Logging CHAPTER
74 CHAPTER This chapter describes how to configure and manage logs for the ASA, and includes the following sections: Information About Logging, page 74-1 Licensing Requirements for Logging, page 74-5 Prerequisites
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner ACCREDITATIONS EXAM INFORMATION The Certified Digital Forensics Examiner exam is taken online through Mile2 s Assessment and Certification System ( MACS ), which is
ECCouncil EC-Council Network Security Administrator. Download Full Version :
ECCouncil 312-38 EC-Council Network Security Administrator Download Full Version : http://killexams.com/pass4sure/exam-detail/312-38 Answer: D QUESTION: 319 Which of the following processes helps the business
Seceon s Open Threat Management software
Seceon s Open Threat Management software Seceon s Open Threat Management software (OTM), is a cyber-security advanced threat management platform that visualizes, detects, and eliminates threats in real
Hillstone IPSec VPN Solution
1. Introduction With the explosion of Internet, more and more companies move their network infrastructure from private lease line to internet. Internet provides a significant cost advantage over private
Optimizing Security for Situational Awareness
Optimizing Security for Situational Awareness BRIAN KENYON McAfee Session ID: SPO1-106 Session Classification: Intermediate p gg able=network_objects, Operation=Update,Administrator=fwadmin, Machine=cp-mgmt-
Scientific Working Group on Digital Evidence
Disclaimer: As a condition to the use of this document and the information contained therein, the SWGDE requests notification by e-mail before or contemporaneous to the introduction of this document, or
Securing CS-MARS C H A P T E R
C H A P T E R 4 Securing CS-MARS A Security Information Management (SIM) system can contain a tremendous amount of sensitive information. This is because it receives event logs from security systems throughout
SOC-2 Requirement Solution Brief. EventTracker 8815 Centre Park Drive, Columbia MD SOC-2
Requirement Solution Brief 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical software and services that transform high-volume cryptic log data into actionable, prioritized intelligence
Cyber Insurance: What is your bank doing to manage risk? presented by
Cyber Insurance: What is your bank doing to manage risk? David Kitchen presented by Lisa Micciche Today s Agenda Claims Statistics Common Types of Cyber Attacks Typical Costs Incurred to Respond to an
Zone-Based Firewall Logging Export Using NetFlow
Zone-Based Firewall Logging Export Using NetFlow Zone-based firewalls support the logging of messages to an external collector using NetFlow Version 9 export format. NetFlow Version 9 export format uses
WHITE PAPER. PCI and PA DSS Compliance with LogRhythm
PCI and PA DSS Compliance with LogRhythm April 2011 PCI and PA DSS Compliance Assurance with LogRhythm The Payment Card Industry (PCI) Data Security Standard (DSS) was developed to encourage and enhance
Implementing Cisco Cybersecurity Operations
210-255 Implementing Cisco Cybersecurity Operations NWExam.com SUCCESS GUIDE TO CISCO CERTIFICATION Exam Summary Syllabus Questions Table of Contents Introduction to 210-255 Exam on Implementing Cisco
Cybersecurity in Higher Ed
Cybersecurity in Higher Ed 1 Overview Universities are a treasure trove of information. With cyber threats constantly changing, there is a need to be vigilant in protecting information related to students,
FRONT RUNNER DIPLOMA PROGRAM Version 8.0 INFORMATION SECURITY Detailed Course Curriculum Course Duration: 6 months
FRONT RUNNER DIPLOMA PROGRAM Version 8.0 INFORMATION SECURITY Detailed Course Curriculum Course Duration: 6 months MODULE: INTRODUCTION TO INFORMATION SECURITY INFORMATION SECURITY ESSENTIAL TERMINOLOGIES
Digital Forensics. Module 1 CS 996
Digital Forensics Module 1 CS 996 Instructors Dr. Frederick Scholl Office Hours: 5-6 PM, Mondays E-mail: freds@monarch-info.com Phone 212-869-4458 I am not a lawyer! Kulesh Shanmugasundaram Professor Nasir
Securing Information Systems
Chapter 7 Securing Information Systems 7.1 Copyright 2011 Pearson Education, Inc. STUDENT LEARNING OBJECTIVES Why are information systems vulnerable to destruction, error, and abuse? What is the business
SDR Guide to Complete the SDR
I. General Information You must list the Yale Servers & if Virtual their host Business Associate Agreement (BAA ) in place. Required for the new HIPAA rules Contract questions are critical if using 3 Lock
Top-Down Network Design
Top-Down Network Design Chapter Eight Developing Network Security Strategies Copyright 2010 Cisco Press & Priscilla Oppenheimer 1 Network Security Design The steps for security design are: 1. Identify
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Data Theft
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
ISO/IEC Solution Brief ISO/IEC EventTracker 8815 Centre Park Drive, Columbia MD 21045
Solution Brief 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical software and services that transform high-volume cryptic log data into actionable, prioritized intelligence that
2017 Annual Meeting of Members and Board of Directors Meeting
2017 Annual Meeting of Members and Board of Directors Meeting Dan Domagala; "Cybersecurity: An 8-Point Checklist for Protecting Your Assets" Join this interactive discussion about cybersecurity trends,
Digital Forensics. Module 6 CS 996
Digital Forensics Module 6 CS 996 Review from Module #5 Class action suits and forensics ADS and slack space Basic Windows investigations Hard drive properties Hard drive case study Disposal of hard drives
Shell Items, Eventlogs, Forensics
Shell Items, Eventlogs, Email Forensics Georgi Nikolov today Shell Items What are shell items? Figure 1: www.pinterest.com Shell Items Overview Data or file holding information for accessing another file
CIT 380: Securing Computer Systems. Network Security Concepts
CIT 380: Securing Computer Systems Network Security Concepts Topics 1. Protocols and Layers 2. Layer 2 Network Concepts 3. MAC Spoofing 4. ARP 5. ARP Spoofing 6. Network Sniffing Protocols A protocol defines
CYBERBIT P r o t e c t i n g a n e w D i m e n s i o n
CYBERBIT P r o t e c t i n g a n e w D i m e n s i o n CYBETBIT in a Nutshell A leader in the development and integration of Cyber Security Solutions A main provider of Cyber Security solutions for the
Financial CISM. Certified Information Security Manager (CISM) Download Full Version :
Financial CISM Certified Information Security Manager (CISM) Download Full Version : http://killexams.com/pass4sure/exam-detail/cism required based on preliminary forensic investigation, but doing so as
FISMA-NIST SP Rev.4 Solution Brief. EventTracker 8815 Centre Park Drive, Columbia MD FISMA NIST SP
FISMA-NIST SP 800-53 Rev.4 Solution Brief 8815 Centre Park Drive, Columbia MD 21045 About delivers business critical solutions that transform high-volume cryptic log data into actionable, prioritized intelligence
Education Network Security
Education Network Security RECOMMENDATIONS CHECKLIST Learn INSTITUTE Education Network Security Recommendations Checklist This checklist is designed to assist in a quick review of your K-12 district or
ProCurve Network Immunity
ProCurve Network Immunity Hans-Jörg Elias Key Account Manager hans-joerg.elias@hp.com 2007 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.
90% 191 Security Best Practices. Blades. 52 Regulatory Requirements. Compliance Report PCI DSS 2.0. related to this regulation
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on April 16, 2018 15:41 PM O verview 1 90% Compliance About PCI DSS 2.0 PCI-DSS is a legal obligation mandated not by government
Logging. About Logging. This chapter describes how to log system messages and use them for troubleshooting.
This chapter describes how to log system messages and use them for troubleshooting. About, page 1 Guidelines for, page 7 Configure, page 8 Monitoring the Logs, page 26 History for, page 29 About System
Avoiding the Pitfalls of Bring Your Own Device Policies
Pitfalls of Bring Device Policies BYOD/T Represents a Constant Battle Between Compliance Objectives and Employee Usability Presenters: Constantinos Dino G. Panagopoulos, Labor and Employment Group Philip
Sarbanes-Oxley Act. Solution Brief. Sarbanes-Oxley Act. EventTracker 8815 Centre Park Drive, Columbia MD 21045
Solution Brief EventTracker 8815 Centre Park Drive, Columbia MD 21045 About EventTracker EventTracker delivers business critical software and services that transform high-volume cryptic log data into actionable,
Configuring Cache Services Using the Web Cache Communication Protocol
Configuring Cache Services Using the Web Cache Communication Protocol Finding Feature Information, page 1 Prerequisites for WCCP, page 1 Restrictions for WCCP, page 2 Information About WCCP, page 3 How
PASS4TEST. IT Certification Guaranteed, The Easy Way! We offer free update service for one year
PASS4TEST IT Certification Guaranteed, The Easy Way! \ http://www.pass4test.com We offer free update service for one year Exam : SCNS Title : SCNS Tactical Perimeter Defense Vendors : EXIN Version : DEMO
What to do if your business is the victim of a data or security breach?
What to do if your business is the victim of a data or security breach? Introduction The following information is intended to help you decide how to start preparing for and some of the steps you will want
UCOP ITS Systemwide CISO Office Systemwide IT Policy. UC Event Logging Standard. Revision History. Date: By: Contact Information: Description:
UCOP ITS Systemwide CISO Office Systemwide IT Policy UC Event Logging Standard Revision History Date: By: Contact Information: Description: 05/02/18 Robert Smith robert.smith@ucop.edu Approved by the CISOs
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Unauthorized Access
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
Defense-in-Depth Against Malicious Software. Speaker name Title Group Microsoft Corporation
Defense-in-Depth Against Malicious Software Speaker name Title Group Microsoft Corporation Agenda Understanding the Characteristics of Malicious Software Malware Defense-in-Depth Malware Defense for Client
Complete document security
DOCUMENT SECURITY Complete document security Protect your valuable data at every stage of your workflow Toshiba Security Solutions DOCUMENT SECURITY Without a doubt, security is one of the most important
MIS5206-Section Protecting Information Assets-Exam 1
Your Name Date 1. Which of the following contains general approaches that also provide the necessary flexibility in the event of unforeseen circumstances? a. Policies b. Standards c. Procedures d. Guidelines
ITdumpsFree. Get free valid exam dumps and pass your exam test with confidence
ITdumpsFree http://www.itdumpsfree.com Get free valid exam dumps and pass your exam test with confidence Exam : 312-50v10 Title : Certified Ethical Hacker Exam (CEH v10) Vendor : EC-COUNCIL Version : DEMO
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 20: Intrusion Prevention Department of Computer Science and Engineering University at Buffalo 1 Lecture Overview Firewalls purpose types locations Network perimeter
The Realities of Data Security and Compliance: Compliance Security
The Realities of Data Security and Compliance: Compliance Security Ulf Mattsson, CTO, Protegrity Ulf.mattsson @ protegrity.com Bio - A Passion for Sailing and International Travel 2 Ulf Mattsson 20 years
INCIDENTRESPONSE.COM. Automate Response. Did you know? Your playbook overview - Elevation of Privilege
Automate Response Congratulations on selecting IncidentResponse.com to retrieve your custom incident response playbook guide. This guide has been created especially for you for use in within your security
Services: Monitoring and Logging. 9/16/2018 IST346: Info Tech Management & Administration 1
Services: Monitoring and Logging 9/16/2018 IST346: Info Tech Management & Administration 1 Recall: Server vs. Service A server is a computer. A service is an offering provided by server(s). HTTP 9/16/2018
Cisco Stealthwatch Improves Threat Defense with Network Visibility and Security Analytics
Solution Overview Cisco Stealthwatch Improves Threat Defense with Network Visibility and Security Analytics BENEFITS Gain visibility across all network conversations, including east-west and north-south
Incident Response. Figure 10-1: Incident Response. Figure 10-2: Program and Data Backup. Figure 10-1: Incident Response. Figure 10-2: Program and Data
Figure 10-1: Incident Response Incident Response Chapter 10 Panko, Corporate Computer and Network Security Copyright 2004 Prentice-Hall Incidents Happen Protections sometimes break down Incident Severity
2. Firewall Management Tools used to monitor and control the Firewall Environment.
Firewall Review Section 1 FIREWALL MANAGEMENT & ADMINISTRATION Common management practices with regard to administering the (company) network should be in accordance with company policies and standards.
Compliance and Privileged Password Management
Introduces Compliance and Privileged Password Management [ W H I T E P A P E R ] Written by Kris Zupan, CEO/CTO e-dmz Security, LLC April 13, 2007 Compliance and Privileged Password Management Overview
Understanding Cisco Cybersecurity Fundamentals
210-250 Understanding Cisco Cybersecurity Fundamentals NWExam.com SUCCESS GUIDE TO CISCO CERTIFICATION Exam Summary Syllabus Questions Table of Contents Introduction to 210-250 Exam on Understanding Cisco
Cisco Security Information Event Management Deployment Guide. Revision: H2CY10
Cisco Security Information Event Management Deployment Guide Revision: H2CY10 The Purpose of this Document This guide focuses on Cisco products and discusses how those products integrate with any third
File Reputation Filtering and File Analysis
This chapter contains the following sections: Overview of, page 1 Configuring File Reputation and Analysis Features, page 5 File Reputation and File Analysis Reporting and Tracking, page 14 Taking Action