COEN 252 Computer Forensics Collecting Network-based Evidence.

Slides:

Advertisements

Similar presentations

Ethical Hacking Module VII Sniffers.

Advertisements

FIREWALLS. What is a Firewall? A firewall is hardware or software (or a combination of hardware and software) that monitors the transmission of packets.

FIREWALLS The function of a strong position is to make the forces holding it practically unassailable —On War, Carl Von Clausewitz On the day that you.

COEN 252 Computer Forensics Remote Sniffer Detection.

11 TROUBLESHOOTING Chapter 12. Chapter 12: TROUBLESHOOTING2 OVERVIEW  Determine whether a network communications problem is related to TCP/IP.  Understand.

Packet Analyzers, a Threat to Network Security. Agenda Introduction The background of packet analyzers LAN technologies & network protocols Communication.

1 Eastern Michigan University Asad Khailany, Eastern Michigan University Dmitri Bagatelia, Eastern Michigan University Wafa Khorsheed, Eastern Michigan.

Chapter 10: Data Centre and Network Security Proxies and Gateways * Firewalls * Virtual Private Network (VPN) * Security issues * * * * Objectives:

Building Your Own Firewall Chapter 10. Learning Objectives List and define the two categories of firewalls Explain why desktop firewalls are used Explain.

Security Presented by : Qing Ma. Introduction Security overview security threats password security, encryption and network security as specific.

System and Network Security Practices COEN 351 E-Commerce Security.

Chapter 12 Network Security.

Intrusion Detection Systems and Practices

This work is supported by the National Science Foundation under Grant Number DUE Any opinions, findings and conclusions or recommendations expressed.

Sniffing the sniffers - detecting passive protocol analysers John Baldock, Intel Corp Craig Duffy, Bristol UWE.

Security Management IACT 918 July 2004 Gene Awyzio SITACS University of Wollongong.

Lesson 13-Intrusion Detection. Overview Define the types of Intrusion Detection Systems (IDS). Set up an IDS. Manage an IDS. Understand intrusion prevention.

COEN 252: Computer Forensics Router Investigation.

Secure Network Design: Designing a Secure Local Area Network IT352 | Network Security |Najwa AlGhamdi1 Case Study

Installing and Maintaining ISA Server. Planning an ISA Server Deployment Understand the current network infrastructure Review company security policies.

Intrusion Detection - Arun Hodigere. Intrusion and Intrusion Detection Intrusion : Attempting to break into or misuse your system. Intruders may be from.

Department Of Computer Engineering

INTRUSION DETECTION SYSTEM

Network Intrusion Detection Systems Slides by: MM Clements A Adekunle The University of Greenwich.

Intrusion Prevention, Detection & Response. IDS vs IPS IDS = Intrusion detection system IPS = intrusion prevention system.

1 Intrusion Detection Systems. 2 Intrusion Detection Intrusion is any use or attempted use of a system that exceeds authentication limits Intrusions are.

Information Systems CS-507 Lecture 40. Availability of tools and techniques on the Internet or as commercially available software that an intruder can.

Intrusion Protection Mark Shtern. Protection systems Firewalls Intrusion detection and protection systems Honeypots System Auditing.

Shared success Outline What is network security? Why do we need security? Who is vulnerable? Common security attacks and countermeasures. How to secure.

AIS, Passwords Should not be shared Should be changed by user Should be changed frequently and upon compromise (suspected unauthorized disclosure)

COEN 252 Computer Forensics

Switch Concepts and Configuration and Configuration Part II Advanced Computer Networks.

Karlstad University Introduction to Vulnerability Assessment Labs Ge Zhang Dvg-C03.

What is FORENSICS? Why do we need Network Forensics?

Objectives Configure routing in Windows Server 2008 Configure Routing and Remote Access Services in Windows Server 2008 Network Address Translation 1.

OV Copyright © 2013 Logical Operations, Inc. All rights reserved. Network Security  Network Perimeter Security  Intrusion Detection and Prevention.

Windows 7 Firewall.

Forensic and Investigative Accounting Chapter 14 Internet Forensics Analysis: Profiling the Cybercriminal © 2005, CCH INCORPORATED 4025 W. Peterson Ave.

FIREWALLS Vivek Srinivasan. Contents Introduction Need for firewalls Different types of firewalls Conclusion.

OV Copyright © 2011 Element K Content LLC. All rights reserved. Network Security  Network Perimeter Security  Intrusion Detection and Prevention.

Intrusion Detection Presentation : 2 OF n by Manish Mehta 02/07/03.

1 CHAPTER 3 CLASSES OF ATTACK. 2 Denial of Service (DoS) Takes place when availability to resource is intentionally blocked or degraded Takes place when.

Network and Perimeter Security Paula Kiernan Senior Consultant Ward Solutions.

Principles of Computer Security: CompTIA Security + ® and Beyond, Third Edition © 2012 Principles of Computer Security: CompTIA Security+ ® and Beyond,

Linux Networking and Security

Firewalls  Firewall sits between the corporate network and the Internet Prevents unauthorized access from the InternetPrevents unauthorized access from.

Network Security. 2 SECURITY REQUIREMENTS Privacy (Confidentiality) Data only be accessible by authorized parties Authenticity A host or service be able.

Intrusion Detection (ID) Intrusion detection is the ART of detecting inappropriate, incorrect, or anomalous activity There are two methods of doing ID.

CHAPTER 9 Sniffing.

Securing the Network Infrastructure. Firewalls Typically used to filter packets Designed to prevent malicious packets from entering the network or its.

1 HoneyNets. 2 Introduction Definition of a Honeynet Concept of Data Capture and Data Control Generation I vs. Generation II Honeynets Description of.

1.1 1 Purpose of firewall : –Control access to or from a protected network; –Implements network access policy connections pass through firewall and are.

Switch Features Most enterprise-capable switches have a number of features that make the switch attractive for large organizations. The following is a.

1 HoneyNets, Intrusion Detection Systems, and Network Forensics.

Discovery 2 Internetworking Module 8 JEOPARDY K. Martin.

Sniffer, tcpdump, Ethereal, ntop

Security fundamentals Topic 13 Detecting and responding to incidents.

Intrusion Detection System

Role Of Network IDS in Network Perimeter Defense.

CSCI 530 Lab Packet Sniffing.

Chapter 11 – Cloud Application Development. Contents Motivation. Connecting clients to instances through firewalls. Cloud Computing: Theory and Practice.

Unit 2 Personal Cyber Security and Social Engineering Part 2.

Firewalls. Overview of Firewalls As the name implies, a firewall acts to provide secured access between two networks A firewall may be implemented as.

CompTIA Security+ Study Guide (SY0-401)

COEN 152 / 252 Computer Forensics

Computer Data Security & Privacy

Introduction to Networking

Chapter 2: Basic Switching Concepts and Configuration

CompTIA Security+ Study Guide (SY0-401)

Intrusion Detection Systems (IDS)

Presentation transcript:

COEN 252 Computer Forensics Collecting Network-based Evidence

Why Surveillance to confirm suspicion, to accumulate evidence, to identify co-conspiritors.

Goals Examine suspicion of incident. Accumulate additional evidence. Verify scope of compromise. Identify additional parties involved. Determine a timeline.

Network Monitoring Event Monitoring Looks for certain types of packets representing events. Trap-and-Trace Monitoring Non-content monitoring. Date, Time, Protocol, Source, Destination Full-Content Monitoring Get complete packages.

Network Monitoring System Match technologies and capabilities to the situation. Goals of network surveillance. Ensure proper legal standing. Acquire proper hardware and software. Ensure the security of the platform. Evaluate the network monitor.

Network Monitoring Goals Watch traffic to and from a specific host. Monitor traffic to and from a specific network. Monitor a specific person’s actions. Verify intrusion attempts. Look for specific attack signatures. Focus on a specific protocol.

Network Monitoring Tools Match hardware power to the task. T3 need 1GHz processor, 1GB RAM Implement proper chain of custody for backup storage. Match software properties to the task. OS Remote access? Silent Sniffer? Capture files in portable format? Technical skills needed for monitor. Amount of data

OS for Sniffing Robust implementation of TCP/IP. SSH for remote access. Simple to disable services. Simple to run local firewall.

Remote Access Network connection. Second network adapter. VLAN SSH Firewall restricts IP addresses. Modem /”Out of Band” communications User ID / password Calls from specific phone numbers.

Silent Sniffing Antisniffers test for cards in promiscuous mode. Sniffers providing name-lookup make DNS queries. Sniffing machines have a higher response rate if the network is flooded. Incorrect implemented TCP/IP stacks react to packets with correct IP address but wrong ethernet address. Physically disable traffic from the card.

Data File Formats Capture files have different formats. Proprietary formats can lock you in. We will use windump and ethereal. Free Work well. Runs on most platforms.

Deploying the Network Monitor Switches Use MAC address to send traffic only to destination machines. Switched Port Analysis (SPAN) allows one switch to transmit all traffic to one switch port.

Deploying the Network Monitor Physical Security Physical Access => Logical Access. Chain of Custody: Capture files need to be authenticated.

Evaluating the Monitor Check Load. Check File System.

Trap-And-Trace Monitors only IP header and TCP header, but no content. Legal Issues: Without user supplied data, less privacy violation for corporate users. Without user supplied data, less need for a warrant. Tcpdump to screen protects private data.

Full-Content-Monitoring Sniffers can capture complete packages. Use a filter to block out noise. Protect capture files to maintain chain of custody. (file naming, scripting, md5)

Network-Based Logs Most network traffic leaves an audit trail. Routers, firewalls, servers, … maintain logs DHCP log IP leases Firewalls offer logging. IDS can capture part of an attack. Host-based sensors detect alteration of libraries Login attempts are logged.