SECURITY 508

System Forensics, Investigation & Response

This advanced course is perfect for the diligent student conversant with Linux System Administration, Windows System Administration, TCP/IP, and Intrusion Detection Methodologies. If you are just beginning in information security, this course is not appropriate for you as the basics of the Linux and Windows operating systems are not covered in this program.

Unpatched, unprotected computers connected to the Internet are being compromised in 3 days or less. The Blaster Worm proves systems behind a firewall can become the victim of a successful attack. Security professionals must master a variety of operating systems, investigation techniques, incident response tactics, and even legal issues. Learn forensic techniques and tools in a lab-style, hands-on setting for both Windows and Linux investigations. This course emphasizes a "try-it-by-hand" approach so that any student attending will take with them a solid grasp of how open source and commercial forensic tools complete their tasks, without having to merely have faith in the tool. This is accomplished by teaching the fundamental concepts of computer forensics in a tool-independent manner.

Beginning with foundation concepts such as file system structures, MAC times, and forensic auditing, the content and difficulty level of this track advances rapidly. You will learn more than just how to use a tool; you will be able to show how the tool is able to recover data, find the smoking gun, and present your data in a format that can be easily understood by others. You'll learn how and when to use various tools such as the Sleuthkit, Autopsy Forensic Browser, the Windows Forensic Toolchest (WFT), and then quickly move on to advanced forensic and incident response topics and techniques. Five days of intense, hands-on courses, and a deep-knowledge education into legal challenges and issues culminate with an over-the-shoulder view of an investigation performed on a real-world compromised system collected by the Honeynet Project.