Term paper on Network Forensics/Intrusion Detection.

[cheyenne1212]

I would maybe start talking about why network forensics has become such a popular area to IT professionals.

What kind of knowledge must you have to be a good network forensics person?

[R0n1n]

First, its analysis not analyses

Second, talk about why you need to do this, what purpose does forensics serve? quote legal requirements, patching holes so you aren`t attacked again etc.. Also who is actually doing this work? (as far as I am aware there are only a small number of professionals who just do forensic work, many times it will be security pros in general).

Next, talk generically about some of the tools and techniques used, don`t go into specific tools, but instead talk about data recovery tools, log analysis, etc...

Then walk through a real life example showing how the various tools and techniques that you previously mentioned are used this way you show them in a practical context. Now my advice would not be to spend pages going through TCP dump output, as this will get a little dull..

Towards the end why not address future advances in the technology, speak about how as attacks get more sophisticated that more sophisticated tools may be required


hope this helps.

[Cybr1d]

lol Ronin...i thought i was making analysis plural that way ...thnx

It helps me a whole bunch. Thank you guys.

I like your sig btw ...but really, Who is guarding the guards?

[R0n1n]

or watching the watchmen?

and that would be telling.

Cybr1d, we have some forensic folk at work, I`ll see if I can dig anything up of use for you.


and lol, I thought i could spell.....

[Tronic]

lol, whitehat your missing a 4 :P

Umm...the intro sounds a little bit too...choppy... 'Computer forensics are, etc etc etc.', that doesn't flow...

Try something like "The world of computerized networking has grown at a vast rate in the last 50 years since it was first implimented. Now, the internet is almost of a new world, and in this world, there is good and bad. The good outweighs the bad some people say..but still, as any community grows there is a need for control and policing. If there wasn't then the community would be in an uproar. One of the tools used by this Police force, is network and computer forensics. Not only is this a safe way to keep the criminals at bay, it's the most effective science for investigation we've come across since the old days of ARPAnet. To combat the wrong doings of the internet, computer forensics has many flavors, but most of all, network and computer forensics is the science of monitoring several computer logs, bundles of software and hardware, and overall communication between every circuit in a computerized environment to determine what, exactly, went wrong. Computer forensics is not only an asset to this community, but it's much needed. Today, it's used to not only prevent future occurences of a crime taking place, but monitor the events of the computer underworld, to know exactly what happened, and when it did, so we can patch ourselves from another occurence. First off i'll go in depth with how computer forensics works.."....etc etc etc.

You sound too choppy in your words..just something i've noticed..dunno if thats what u were goin for but ya..people like flow more then choppy facts as i've seen. Just my 2c.