Network Intrusion Management and Profiling
Jr., Albert, Robert S. Marcella, Greenfield · Auerbach Publications eBooks · 2002
Computer forensics covers a wide range of technical areas. One of the most complex types of computer forensics activities is the investigation of a network intrusion. A network intrusion is the compromise of a networked computer. This is popularly known as the hacking case. Although this type of security incident seems straightforward — a computer has been broken into — the ensuing response and investigation is a complicated exercise. With the proliferation of networks, both public and private, connectivity is growing every day. There are also several famous hacking cases, such as the Kevin Mitnick case and the Phonemasters investigation. These incidents turned into complex investigations that spanned a number of systems, multiple organizations, and various jurisdictions. One of the major tasks during an investigation of this type is to properly manage the activities during the investigation while maintaining consistency and integrity of any forensic evidence.