EnCaseŽ v6 Network Intrusion Investigations I



			Go to EnCase Computer Forensic courses.

[Email] [Print] [Save]

EnCaseŽ v6 Network Intrusion Investigations I

Vendor Course Code:

Course Length:

4 days

Course Price:

$3,600.00 + GST

Availability:

If your preferred city or time is not currently listed, please call DDLS on 13 12 01 and we can try to accommodate your needs.

Overview:

This hands-on course is designed for investigators who want to learn more about network intrusions, the tools commonly used by attackers and the forensic artifacts left behind. This course goes into the technical aspects of network intrusions, as well as the methodology commonly used by attackers. The course will begin with an overview of networking protocols and then quickly address topics such as session hijacking, capturing network traffic and the importance of collecting volatile data (which can contain significant forensic artifacts).

The course combines forensic examinations with live response in a network environment. Students learn how to examine a compromised server or workstation in the field to obtain log files and forensic images of hard disk drives. Students examine server log files and forensic artifacts for evidence of the attacker's methods and activities.

This course covers several aspects of Trojan virus infection, as well as how investigators and examiners can combat the Trojan virus defense ("It wasnt me!").

Students will take part in real-world scenarios by performing several different types of attacks on a mock victim machine and then examining the victim computer using EnCase to identify the artifacts they left behind by the "attacker." Many different types of tools and programs will be discussed and used during the course to familiarise the investigator with common tools and methods used to gain unauthorized access, and how those tools and methods can be readily identified during a forensic examination.

In addition to the various "hacker" tools, students will also utilize and discuss a variety of forensic tools, including the EnCase Enterprise Edition (network version) and network intrusion EnScriptsŽ for live incident response and collection of volatile data important to network intrusion investigations. Students will also discuss the use of the EnCase Enterprise Edition for internal investigations over an organisation's Local Area Network.

Skills Gained:

Use of virtualized environments in investigations

The hacker mind and security policy

Collection of volatile data from live system

Knowledge of viruses

Hiding and manipulating data

Trojans and Malware

Combating the Trojan virus defense

Footprinting and vulnerability scanning

Webserver attacks

Wireless security and vulnerabilities

Analyzing network traffic (sniffing)

Netbios/FileSharing attacks

WindowsŽ rootkits

Key Topics:

Day one provides an overview of working with VMware to create virtual machines for testing purposes. Students are introduced to attacker methodology and motivations, the basics of incident response and the importance of a good security policy are discussed.
- Using VMware and Examining Virtual Machines in EnCase
- The Hacker Mind and Methodology
- Incident Response and Security Policy
- Network Hardware Devices
- TCP/IP Overview
- Understanding Ports
- Footprinting & Scanning

Day two allows students to conduct NetBIOS and file sharing attacks in a manner consistent with a "real-world" intrusion, and view the resulting forensic artifacts.
- NetBIOS and WindowsŽ File Sharing
- Manipulation and Obfuscation of Data
- Analyzing Network Traffic
- Wireless Sniffing and Security

Day three takes students through additional areas of intrusion investigation and forensics, presenting numerous tools for targeted incident response.
- Snort Intrusion Detection System (IDS)
- Incident Response Toolkit and Duplications
- Volatile Data Collection
- System Snapshot with EnCase EnterpriseŽ and Compromise Assessment
- Windows Registry

Day four exposes students to malware and Trojan file infections, the use of binary packing software and forensic detection of packed files and Trojan file delivery and start-up methods.
- Packers and Compressors
- Trojan Viruses
- Optix Pro Remote Control
- Internet Information Services (IIS) Exploit

Target Audience:

This course is intended for corporate and government/law enforcement investigators, legal professionals and network security personnel. Incident response supervisors and team members are encouraged to attend, as are individuals working in a penetration testing or network intrusion investigation role. An understanding of the concepts of computer forensics and familiarity with the EnCase forensic software is required. Knowledge of computer networking hardware, protocols and concepts is helpful, but not required.

Class curriculum is designed to provide a good overview of network security and intrusion investigation issues, both from a forensic and intruder perspective.

Prerequisites:

The EnCaseŽ Computer Forensics II course or EnCE Certification are prerequisits for this course. Students should have a good understanding of network topology and TCP/IP. Advance preparation for this course is not required.