Sources and Data
What is SNORT
Snort is an open source network intrusion prevention system (NIPS) and network intrusion detection system (NIDS) developed by Sourcefire.
What is the one thing you should never do during a digital forensics investigation?
Digital forensic investigation is the science of collecting and examining electronic evidence that can evaluate damage to a computer as a result of an electronic attack or that can recover lost information from a system in order to prosecute a criminal. To prevent tampering and alteration of the suspect data, a data forensic analysis should be conducted on a copy of the suspect computer. Furthermore, restarting a computer may change or overwrite files and inadvertently destroy evidence.
DON'T REBOOT!!!!!!
What is a False Negative?
A false negative is where no alert exists and exploits are not being detected by the security systems that are in place.
What is Tor browser?
The Tor Browser is a web broswer that anonymizes your web traffic using the Tor network, making it easy to protect your identity online
One of the best known packet sniffer and analysis tool is
Wireshark
What is FTK Imager
Is a data preview and imaging tool that lets you quickly assess electronic evidence
Why are timestamps important?
So you know when an event happened. You can sort all the data by time the incident happened and ignore the unnecessary data.
What is a False Positive?
False positives are not desirable. Although they do not indicate that an undetected exploit has occurred, they are costly because cybersecurity analysts musts investigate false alarms; therefore, time is taken away from investigation of alerts that indicate true exploits.
What is Corroborating evidence?
Corroborating evidence is evidence that supports a proposition already supported by initial evidence, therefore confirming the original proposition.
Tool that can be used to scan live hosts on a network, perform port scanning, ping sweeps, OS detection, and version detection.
NMap
What do you do with IPsec and SSL traffic?
To reduce the huge amount of data collected so that cybersecurity analysts can focus on critical threats, some less important or unusable data could be eliminated from the datasets. For example, encrypted data, such as IPsec and SSL traffic, could be eliminated because it is unreadable in a reasonable time frame.
What are Regular expressions and how do they work?
Regular expressions allow forensics analysts to search through large quantities of text information for patterns of data. Some common operators used in regular expressions are as follows:
$ End of a line.
[] Any single value within the square brackets.
* Preceding sub-expression zero or more times.
[^1] Any character except those bound by the [^ and the].
What is a True Negative?
True negatives are also desirable. They indicate that normal traffic is correctly ignored and erroneous alerts are not being issued.
What is Circumstantial evidence?
Circumstantial evidence is evidence other than first-hand accounts of events provided by witnesses.
Fifth layer of OSI model is
Session layer
What is normalization?
For processing log entries, data normalization can organize and convert data values in datasets from difference sources into common format. The normalization makes it easy for further data analysis and reporting.
What is the hash value of files used for?
If a cybersecurity analyst is suspicious of the file, the hash value can be submitted to an online malware repository site to determine if the file is known malware.
What is a True Positive?
False negatives are dangerous. They indicate that exploits are not being detected by the security systems that are in place. These incidents could go undetected for a long time, and ongoing data loss and damage could result.
What is Best evidence?
Best evidence – This is evidence that is in its original state. This evidence could be storage devices used by an accused, or archives of files that can be proven to be unaltered.
Name methodology used for Cybsersecurity Architecture
SABSA
What is Security Onion?
Security Onion is a Linux distro for intrusion detection, network security monitoring, and log management.
What is a API?
Application programming interface (API).
Application programs interact with an operating system through system calls to the OS application programming interface (API). These system calls allow access to many aspects of system operation such as software process control, file management, device management, and network access.
What are the 4 digital forensics processes of NIST ?
NIST describes the digital forensics process as involving the following four steps:
Collection - the identification of potential sources of forensic data and acquisition, handling, and storage of that data.
Examination - assessing and extracting relevant information from the collected data. This may involve decompression or decryption of the data.
Analysis - drawing conclusions from the data. Salient features such as people, places, times, events, and so on should be documented.
Reporting - preparing and presenting information that resulted from the analysis. Reporting should be impartial and alternative explanations should be offered if appropriate.
What is Indirect evidence?
Indirect evidence – This is evidence that, in combination with other facts, establishes a hypothesis. This is also known as circumstantial evidence. For example, evidence that an individual has committed similar crimes can support the assertion that the person committed the crime of which they are accused.
Origin of the word Forensics
Latin