Describe how to investigate an intrusion event such as a redirect attack on a Windows laptop with malware upload. What would you likely discover going through the laptop and network information (hint: going through pcap files, system logs, security logs, and registry hive (ntuser.dat, etc...))? How would you assess system and network artifacts for correctness and significance?

Describe how to investigate an intrusion event such as a redirect attack on a Windows laptop with malware upload. What would you likely discover going through the laptop and network information (hint: going through pcap files, system logs, security logs, and registry hive (ntuser.dat, etc...))? How would you assess system and network artifacts for correctness and significance?

Systems Architecture

7th Edition

ISBN:9781305080195

Author:Stephen D. Burd

Publisher:Stephen D. Burd

Chapter14: System Administration

Section: Chapter Questions

Problem 12RQ

See similar textbooks

Similar questions

Computer Science Describe how to investigate an intrusion incident such as a redirect attack on a Windows laptop, with malware upload, what would you likely find going through the laptop and network information (hint: going through pcap files, system logs, security logs, and registry hive (ntuser.dat, etc...), and the file looking for artifacts)? In your opinion, how would you likely validate findings (artifacts), to confirm their accuracy and significance, found on the system and network?
Analyze an intrusion event, such as a redirect assault on a Windows laptop with malware upload, by looking at the laptop and network data (hint: check for artefacts). How would you likely check system and network findings (artefacts) for accuracy and significance?
Discuss the role of intrusion detection systems (IDS) and intrusion prevention systems (IPS) in network security. How do they differ from firewalls?
What is key difference between firewall and intrusion detection system? Make a comparison between host based and network based firewall, and host based and network based intrusion detection system?
Given the list of possible active attacks; os exploits, virus, trojan, syn scan, Ack Scan, and web Attacks and given a firewall between the Internet (represented by a cloud) and your network router. which of these types of attacks are not able to be prevented through the firewall? why are these types of attacks not able to be prevented through the firewall? How can these attacks be prevented from taking place?
Assuming your organization or institution's e-mail server is always susceptible to spams and other malwares. As a network system security expert what would you recommend to mitigate such challenges?
Let's say you're employed by a company that uses a firewall to keep its internal network secure from the Internet and other external threats. Do you think it's a good idea for all corporate workstations, not just the ones in the office, to have their own personal firewalls installed and configured? So, why is this happening, or why isn't it?
Envision yourself employed by a company that employs a firewall to prevent unapproved access to its private network from the Internet and other external sources. To what extent do you agree that all corporate workstations, not just the ones in the office, should have personal firewalls installed and configured? What may possibly be the cause of this, if anything?
Which firewall management solutions do you think are the most effective, in your opinion? Explain?
What is the primary purpose of a firewall?On packet filtering software, I'm working. What are the guidelines I need to follow?
Examine a few of the justifications for why people don't bother to protect their computers against network threats. Check for security features including software updates and passwords. Think about the architecture, cost, and other aspects as well.
How does Windows Firewall operate, and what advanced configurations can be implemented to enhance network security?