>> Hi, everyone. Welcome back to the course.
In the last module, we wrapped up
our discussion on operating system forensics.
In this module, we're going to
talk about network forensics.
Just a quick pre-assessment question.
Real-time analysis occurs after an attack is complete,
is that true or false?
That's false, so the name gives it away there.
Real-time would actually be in
real time. Network forensics.
Basically, as the name implies,
this is related to the monitoring or
analysis of network traffic.
Basically, that's used to
discover the source of attacks or other problems.
If there's a crime committed and we feel
that the information might
be in different packets on the network,
for example, thinking like child pornography.
The bad person is going out to
this child porn website, they're downloading files.
We may be able to grab some good information about
that communication stream inside of the network traffic.
One thing to keep in mind is that
network traffic is going to be volatile.
Generally, our best bet is going to be
real-time analysis if we can get it.
However, we could do postmortem as well.
Speaking of both of those,
the real-time as I mentioned,
is going to be the event is actually still occurring.
The attacker is still accessing that website,
an attacker is still hacking our systems,
whatever the case might be.
Then postmortem, as the name implies, it's after.
Nobody dies, hopefully not.
But postmortem is going to be after the event.
Log files as evidence.
You just want to understand how we can
use log files as evidence in some of the aspects of it.
With the federal rules of evidence or
FRE as I have abbreviated there,
it goes over the hearsay rule.
Normally, things are not admissible if it's hearsay.
Technically, if you think about it in that context,
we'll talk about the exclusion in a moment here.
But if you think about it in that context,
you can't really question the log server.
You can't go up and say, "Hey,
were you really at the club on
Friday night at 3:00 AM to witness this?"
The log server is just a machine.
It doesn't talk to you. In that context,
they had to put an exclusion for things like that.
Thinking about it that way,
the exclusion is if things are
collected as part of normal business operations,
if you can prove that we always collect logs,
we didn't just collect it
on Friday at 3:00 AM at the club.
We collected it Monday,
Tuesday, Wednesday, Thursday, Friday,
and we've done this forever,
and we have also collected it after the event as well.
Basically, the way it's admissible here,
again, this is not legal advice by any means.
But the way it's admissible here is basically you have to
prove that you've been collecting these logs before,
during, and after the event
and you have to be able to produce that, etc.
Basically, that establishes trustworthiness
as well to show that yes,
we are doing it this way.
These are the logs,
this is the information. These are not altered.
Going back to the chain of custody
that we've hammered out throughout this entire course,
going back to that aspect of it of making sure that
this data is the data that is actually from the logs.
Event correlation.
Just a few ones that you'll want to know here.
There's other ones as well.
As I mentioned throughout the course,
you have the free notes and
everything in the supplemental resources,
download those and study them.
They're going to help you immensely for
the CHFI exam if you decide to go take it.
If you decide not to take it,
they're definitely going to be helpful for you to
understand different knowledge points for
a career in digital forensics.
Codebook-based, rule-based,
automated field correlation, Bayesian,
and then also time and role-based,
we'll talk about each one of those at a high level.
Code-based. Here, as the name implies, have a codebook.
It just stores sets of events in code.
Think of it like a master codebook
or like a cheat codebook for your games.
Rule-based, as the name applies,
rules are used to correlate different events.
Automated field correlation,
basically this compares different fields of
the data and determines
if there's any actual correlation.
Almost thinking along the lines of AI type of thing.
Bayesian, this one uses statistics and probability.
You just want to make sure you
memorize that aspect for your exam.
If you ever see anything
asked about which one uses statistics,
it's going to be the Bayesian.
Then time or role-based,
this one just monitors a user or
computer behavior for abnormal activity.
Network time protocol,
you just want to know basically what
NTP stands for for the exam.
This one essentially is synchronizing the clocks across
all the network devices and synchronizing
those to coordinated universal time or UTC.
UTC is something you just want to
memorize what that stands for.
Again, it stands for coordinated universal time.
Just memorize that for your exam.
What devices have logs?
A whole lot of them essentially is the answer.
But your router, your firewall,
your intrusion detection and prevention systems,
your honeypots, DHCP, ODBC,
which is open database connectivity, etc.
Essentially, almost all the devices on
your network are going to have some type of logging,
which presents an inherent challenge.
If all of them are sending us logs, what do we do?
Talking about challenges here.
Again, all of them are sending us logs
so we have a variety of logs.
The sources of data are distributed as well.
Also the data sources change a lot.
Depending on what we're plugging into our network,
the data sources can change or even with updates,
a provider may actually change the way
the logs are being disseminated from the machine.
All those things can be very fluid.
Sensitivity of data is another challenge.
If we're working with classified information,
but not all our systems
are working with classified data,
what do we do? How do we handle that?
Formatting of the log data,
the logs themselves can
come with different formatting on the files.
Also, log fatigue is a challenge.
Basically, as a network admin
or security engineer or analyst,
you're going to be inundated with a larger company
possibly terabytes of data coming in
daily that are coming to you and it's like,
okay, well, how do I look through all this?
You get log fatigue in the aspect
of everything starts jumbling
together and looking the same.
That's where AI and stuff like that is important in
different scripts to try to reduce some of that
on you. Retention of logs.
If we're getting terabytes of data a day
, where are storing this?
How long do we want to store certain log information for?
When can we purge it to try to clear
up some stuff and not make it cost so much?
Then also centralized logging is one solution
to all of this, [NOISE] excuse me,
where we can just have
all the logging information come to a central location.
Think of a tool like Splunk, for example,
where we point all our log stuff to Splunk
and then Splunk gives us that wonderful dashboard
where we can go in there and we can set
custom scripts and then we can just get
it spitting out information that we actually care about.
Syslog is something else that you can use.
Basically, this separates the log generation,
log storage, and log analysis.
It's a central repository for printers, routers, etc.
It just gives that central repository for the logs.
Just one post-assessment question.
Routers are the only device on
a network that do not have logs.
Is that true or false?
That one is actually really easy.
That one is obviously false
because routers do have logs and
basically almost every device on
the network should have a log attached to it.
In this video, we just covered at
a high level network forensics,
some of the key points that you want
to just know for your exam.
In the next module, we're going to go
over the investigation of web attacks.