Description

This advanced course will show you the essential techniques for carrying out a post-mortem analysis (also called inforensic) of computer security incidents. Following attack simulations, you will learn how to collect and preserve evidence, analyze it and improve IT security after the intrusion.

Who is this training for ?

For whom ?

Systems and network engineer/administrator, responsible for security.

Prerequisites

Training objectives

Master good reflexes in the event of an intrusion on a machine

Collect and preserve the integrity of electronic evidence

Analyze the intrusion a posteriori

Improve your security after an intrusion

Training program

• Forensic (or inforensic) analysis of systems
  • Computer forensics.
  • Types of computer crimes.
  • Role of the computer investigator.
• Modern Cybercrime
  • Types of crime.
  • Security incident management framework, CERT.
  • Analyze and understand network attacks.
  • Network intrusion detection.
  • Protection tools, French legislation.
  • Practical work Analyze network logs from a Volumetric DDoS, ARP.
  • Setting up SNORT.
• Forensic analysis of a Windows operating system
  • Acquisition, analysis and response.
  • Understanding the startup processes.
  • Collect volatile and non-volatile data.
  • How the system works password, Windows registry.
  • Analysis of data contained in RAM, Windows files.
  • Analysis of cache, cookie and browsing history, event history.
  • Practical work Injecting a user.
  • Crack the password.
  • Collect, analyze data from RAM.
  • Reference, hash all files.
  • Explore browser data, registry.
• Log analysis
  • Visualize, sort, search in traces.
  • Splunk to understand attacks.
  • Practical work Install, configure Splunk.
  • Analyze Web logs from a Brute-Force on Form, implementation of countermeasures.
• Collection of information
  • Heterogeneity of sources.
  • What is a security event? Security Event Information Management (SIEM), events collected from the IS.
  • System logs of equipment (firewalls, routers, servers, databases).
  • Practical work Geolocation of addresses.
  • Analysis of web user history (cookie, data sent POST).
  • Analyze Web logs from SQL Injection and implement countermeasures.
• Digital proof
  • Definition, role, types and classification rules.
  • Evaluate and secure electronic elements of a crime scene.
  • Collect and preserve the integrity of electronic evidence.
  • Practical work Duplicate data bit by bit, check integrity.
  • Recover deleted and/or hidden files.
  • Analysis of digital data.