<P style="MARGIN: 0px">Breach detection is one of the hottest topics in cyber security. As more devices become Internet capable, more systems become targets. This in turn increases the need for digital defenses meaning the intended audience will continue to grow and expand across all business sectors. This book is&nbsp;a guide for various levels of technical competencies. Business minded people and executives would benefit from the incident response and policy content. Network administrators will benefit from the breach detection best practices content. Security experts will benefit from the technical forensics tools and exercises. Unlike the very few books on this topic, this book will be developed as a guide that can be easily applied to any organization&rsquo;s business practice.</P>

<p>Introduction xix</p><p><strong>Chapter 1</strong> Digital Forensics 1</p><p>Defining Digital Forensics 3</p><p>Engaging Forensics Services 4</p><p>Reporting Crime 7</p><p>Search Warrant and Law 9</p><p>Forensic Roles 13</p><p>Forensic Job Market 15</p><p>Forensic Training 16</p><p>Summary 23</p><p>References 24</p><p><strong>Chapter 2</strong> Cybercrime and Defenses 25</p><p>Crime in a Digital Age 27</p><p>Exploitation 31</p><p>Adversaries 34</p><p>Cyber Law 36</p><p>Summary 39</p><p>Reference 39</p><p><strong>Chapter 3</strong> Building a Digital Forensics Lab 41</p><p>Desktop Virtualization 42</p><p> VMware Fusion 43</p><p> VirtualBox 44</p><p>Installing Kali Linux 44</p><p>Attack Virtual Machines 52</p><p>Cuckoo Sandbox 56</p><p> Virtualization Software for Cuckoo 58</p><p> Installing TCPdump 58</p><p> Creating a User on VirtualBox for Cuckoo 59</p><p>Binwalk 60</p><p>The Sleuth Kit 61</p><p>Cisco Snort 62</p><p>Windows Tools 67</p><p>Physical Access Controls 68</p><p>Storing Your Forensics Evidence 71</p><p> Network Access Controls 72</p><p>Jump Bag 74</p><p>Summary 74</p><p>References 75</p><p><strong>Chapter 4</strong> Responding to a Breach 77</p><p>Why Organizations Fail at Incident Response 78</p><p>Preparing for a Cyber Incident 80</p><p>Defining Incident Response 81</p><p>Incident Response Plan 82</p><p>Assembling Your Incident Response Team 84</p><p> When to Engage the Incident Response Team 85</p><p> Outstanding Items that Often Get Missed with Incident Response 88</p><p> Phone Tree and Contact List 88</p><p> Facilities 89</p><p>Responding to an Incident 89</p><p>Assessing Incident Severity 91</p><p>Following Notification Procedures 92</p><p>Employing Post-Incident Actions and Procedures 93</p><p>Identifying Software Used to Assist in Responding to a Breach 93</p><p> Trend Analysis Software 94</p><p> Security Analytics Reference Architectures 94</p><p> Other Software Categories 97</p><p>Summary 97</p><p>References 98</p><p><strong>Chapter 5</strong> Investigations 99</p><p>Pre-Investigation 100</p><p>Opening a Case 102</p><p>First Responder 105</p><p>Device Power State 110</p><p>Search and Seizure 113</p><p>Chain of Custody 118</p><p>Network Investigations 121</p><p>Forensic Reports 127</p><p> Case Summary 129</p><p> Example 129</p><p> Acquisition and Exam Preparation 129</p><p> Example 129</p><p> Findings 130</p><p> Example 130</p><p> Conclusion 130</p><p> Example 131</p><p> List of Authors 131</p><p> Example 131</p><p>Closing the Case 132</p><p>Critiquing the Case 136</p><p>Summary 139</p><p>References 139</p><p><strong>Chapter 6</strong> Collecting and Preserving Evidence 141</p><p>First Responder 141</p><p>Evidence 144</p><p> Autopsy 145</p><p> Authorization 147</p><p>Hard Drives 148</p><p> Connections and Devices 150</p><p> RAID 152</p><p>Volatile Data 153</p><p> DumpIt 154</p><p> LiME 154</p><p> Volatility 156</p><p>Duplication 158</p><p> dd 161</p><p> dcfldd 161</p><p> ddrescue 162</p><p> Netcat 162</p><p> Guymager 163</p><p> Compression and Splitting 164</p><p>Hashing 166</p><p> MD5 and SHA Hashing 168</p><p> Hashing Challenges 169</p><p>Data Preservation 170</p><p>Summary 172</p><p>References 172</p><p><strong>Chapter 7</strong> Endpoint Forensics 173</p><p>File Systems 174</p><p> Locating Data 178</p><p> Unknown Files 180</p><p>Windows Registry 182</p><p> Deleted Files 185</p><p> Windows Recycle Bin 187</p><p> Shortcuts 189</p><p>Printer Spools 190</p><p> Slack Space and Corrupt Clusters 191</p><p> Alternate Data Streams 196</p><p> Mac OS X 198</p><p> OS X Artifacts 199</p><p>Log Analysis 202</p><p>IoT Forensics 207</p><p>Summary 210</p><p>References 211</p><p><strong>Chapter 8</strong> Network Forensics 213</p><p>Network Protocols 214</p><p>Security Tools 215</p><p> Firewall 219</p><p> Intrusion Detection and Prevention System 219</p><p> Content Filter 219</p><p> Network Access Control 220</p><p> Packet Capturing 223</p><p> NetFlow 224</p><p> Sandbox 225</p><p> Honeypot 226</p><p> Security Information and Event Manager (SIEM) 228</p><p> Threat Analytics and Feeds 229</p><p> Security Tool Summary 229</p><p>Security Logs 229</p><p>Network Baselines 233</p><p>Symptoms of Threats 235</p><p> Reconnaissance 235</p><p> Exploitation 238</p><p> Malicious Behavior 242</p><p> Beaconing 244</p><p> Brute Force 249</p><p> Exfiltration 250</p><p> Other Indicators 254</p><p>Summary 255</p><p>References 255</p><p><strong>Chapter 9</strong> Mobile Forensics 257</p><p>Mobile Devices 258</p><p> Investigation Challenges 258</p><p>iOS Architecture 259</p><p>iTunes Forensics 261</p><p>iOS Snapshots 263</p><p>How to Jailbreak the iPhone 265</p><p>Android 266</p><p>PIN Bypass 270</p><p> How to Brute Force Passcodes on the Lock Screen 271</p><p>Forensics with Commercial Tools 272</p><p>Call Logs and SMS Spoofing 274</p><p>Voicemail Bypass 275</p><p>How to Find Burner Phones 276</p><p>SIM Card Cloning 278</p><p>Summary 279</p><p>Reference 279</p><p><strong>Chapter 10</strong> Email and Social Media 281</p><p>A Message in a Bottle 281</p><p>Email Header 283</p><p>Social Media 288</p><p>People Search 288</p><p>Google Search 293</p><p>Facebook Search 297</p><p>Summary 304</p><p>References 305</p><p><strong>Chapter 11</strong> Cisco Forensic Capabilities 307</p><p>Cisco Security Architecture 307</p><p>Cisco Open Source 310</p><p>Cisco Firepower 312</p><p>Cisco Advanced Malware Protection (AMP) 313</p><p>Cisco Threat Grid 319</p><p>Cisco Web Security Appliance 322</p><p>Cisco CTA 323</p><p>Meraki 324</p><p>Email Security Appliance 326</p><p>Cisco Identity Services Engine 328</p><p>Cisco Stealthwatch 331</p><p>Cisco Tetration 335</p><p>Cisco Umbrella 337</p><p>Cisco Cloudlock 342</p><p>Cisco Network Technology 343</p><p>Summary 343</p><p>Reference 343</p><p><strong>Chapter 12</strong> Forensic Case Studies 345</p><p>Scenario 1: Investigating Network Communication 346</p><p> Pre-engagement 347</p><p> Investigation Strategy for Network Data 348</p><p> Investigation 350</p><p> Closing the Investigation 355</p><p>Scenario 2: Using Endpoint Forensics 357</p><p> Pre-engagement 357</p><p> Investigation Strategy for Endpoints 358</p><p> Investigation 359</p><p> Potential Steps to Take 360</p><p> Closing the Investigation 362</p><p>Scenario 3: Investigating Malware 364</p><p> Pre-engagement 364</p><p> Investigation Strategy for Rogue Files 365</p><p> Investigation 365</p><p> Closing the Investigation 369</p><p>Scenario 4: Investigating Volatile Data 370</p><p> Pre-engagement 371</p><p> Investigation Strategy for Volatile Data 372</p><p> Investigation 373</p><p> Closing the Investigation 375</p><p>Scenario 5: Acting as First Responder 377</p><p> Pre-engagement 377</p><p> First Responder Strategy 377</p><p> Closing the Investigation 379</p><p>Summary 381</p><p>References 382</p><p><strong>Chapter 13</strong> Forensic Tools 383</p><p>Tools 384</p><p> Slowloris DDOS Tool: Chapter 2 385</p><p> Low Orbit Ion Cannon 386</p><p> VMware Fusion: Chapter 3 386</p><p> VirtualBox: Chapter 3 387</p><p> Metasploit: Chapter 3 388</p><p> Cuckoo Sandbox: Chapter 3 389</p><p> Cisco Snort: Chapter 3 389</p><p> FTK Imager: Chapters 3, 9 390</p><p> FireEye Redline: Chapter 3 391</p><p> P2 eXplorer: Chapter 3 392</p><p> PlainSight: Chapter 3 392</p><p> Sysmon: Chapter 3 393</p><p> WebUtil: Chapter 3 393</p><p> ProDiscover Basics: Chapter 3 393</p><p> Solarwinds Trend Analysis Module: Chapter 4 394</p><p> Splunk: Chapter 4 394</p><p> RSA Security Analytics: Chapter 4 395</p><p> IBM&rsquo;s QRadar: Chapter 4 396</p><p> HawkeyeAP: Chapter 4 396</p><p> WinHex: Chapters 6, 7 396</p><p> OSForensics: Chapter 6 397</p><p> Mount Image Pro: Chapter 6 397</p><p> DumpIt: Chapter 6 398</p><p> LiME: Chapter 6 398</p><p> TrIDENT: Chapter 7 398</p><p> PEiD: Chapter 7 399</p><p> Lnkanalyser: Chapter 7 399</p><p> Windows File Analyzer: Chapter 7 399</p><p> LECmd: Chapter 7 401</p><p> SplViewer: Chapter 7 401</p><p> PhotoRec: Chapter 7 402</p><p> Windows Event Log: Chapter 7 402</p><p> Log Parser Studio: Chapter 7 403</p><p> LogRhythm: Chapter 8 403</p><p>Mobile Devices 404</p><p> Elcomsoft: Chapter 9 404</p><p> Cellebrite: Chapter 9 404</p><p> iPhone Backup Extractor: Chapter 9 405</p><p> iPhone Backup Browser: Chapter 9 405</p><p> Pangu: Chapter 9 405</p><p> KingoRoot Application: Chapter 9 405</p><p>Kali Linux Tools 406</p><p> Fierce: Chapter 8 406</p><p> TCPdump: Chapter 3 406</p><p> Autopsy and Autopsy with the Sleuth Kit: Chapters 3, 6 406</p><p> Wireshark: Chapter 8 406</p><p> Exiftool: Chapter 7 407</p><p> DD: Chapter 6 407</p><p> Dcfldd: Chapter 6 408</p><p> Ddrescue: Chapter 6 408</p><p> Netcat: Chapter 6 408</p><p> Volatility: Chapter 6 408</p><p>Cisco Tools 408</p><p> Cisco AMP 408</p><p> Stealthwatch: Chapter 8 409</p><p> Cisco WebEx: Chapter 4 409</p><p> Snort: Chapter 11 409</p><p> ClamAV: Chapter 10 409</p><p> Razorback: Chapter 10 410</p><p> Daemonlogger: Chapter 10 410</p><p> Moflow Framework: Chapter 10 410</p><p> Firepower: Chapter 10 410</p><p> Threat Grid: Chapter 10 410</p><p> WSA: Chapter 10 410</p><p> Meraki: Chapter 10 411</p><p> Email Security: Chapter 10 411</p><p> ISE: Chapter 10 411</p><p> Cisco Tetration: Chapter 10 411</p><p> Umbrella: Chapter 10 411</p><p> Norton ConnectSafe: No Chapter 412</p><p> Cloudlock: Chapter 10 412</p><p>Forensic Software Packages 413</p><p> FTK Toolkit: Chapter 3 413</p><p> X-Ways Forensics: Chapter 3 413</p><p> OSforensics: Chapter 6 414</p><p> EnCase: Chapter 7 414</p><p> Digital Forensics Framework (DFF): Chapter 7 414</p><p>Useful Websites 414</p><p> Shodan: Chapter 1 414</p><p> Wayback Machine: Chapter 3 415</p><p> Robot.txt files: Chapter 2 415</p><p> Hidden Wiki: Chapter 2 415</p><p> NIST: Chapter 4 416</p><p> CVE: Chapter 4 416</p><p> Exploit-DB: Chapter 4 416</p><p> Pastebin: Chapters 4, 10 416</p><p> University of Pennsylvania Chain of Custody Form: Chapter 6 417</p><p> List of File Signatures: Chapter 9 417</p><p> Windows Registry Forensics Wiki: Chapter 7 417</p><p> Mac OS Forensics Wiki: Chapter 7 417</p><p>Miscellaneous Sites 417</p><p> Searchable FCC ID Database 418</p><p> Service Name and Transport Protocol Port Number Registry 418</p><p> NetFlow Version 9 Flow-Record Format 418</p><p> NMAP 418</p><p> Pwnable 418</p><p> Embedded Security CTF 419</p><p> CTF Learn 419</p><p> Reversing.Kr 419</p><p> Hax Tor 419</p><p> W3Challs 419</p><p> RingZer0 Team Online CTF 420</p><p> Hellbound Hackers 420</p><p> Over the Wire 420</p><p> Hack This Site 420</p><p> VulnHub 420</p><p> Application Security Challenge 421</p><p> iOS Technology Overview 421</p><p>Summary 421</p><p>9781587145025 TOC 1/10/2017</p> 

Joseph Muniz

Aamir Lakhani

Investigating the Cyber Breach: The Digital Forensics Guide for the Network Engineer

A digital version of the text you can personalize and read online or offline.

eTextbook

This product is a bound, printed text book.

Print

Paperback

For School

For College & University

For Work

Explore Pearson

College

Uni Students

Uni Educators

Uni Store

BTEC qualifications & short courses

Higher Nationals & Higher Technical qualifications

Apprenticeships

T Levels

Functional Skills

GCSEs

A Levels

Educator Resources & Training

For Educators

Learners - 16-18 years

Learners - 19+ years

All Learner Resources

For Learners & Parents

HE Contact for Students​

HE Contact for Educators​

HE Contact for Businesses​

HE Training for Digital Platforms​

FE Support for Colleges

Get Support

Events

BTEC Educator Blog

VQ Bulletin Blog

Learn & Connect

Browse and buy

Study Tools & Apps

Pearson eTextbook

Free Wellbeing Resource

Careers

Shop for University

Mastering

MyLab

Revel

Redeem an Access Code

HE Contact for Students

Help for University Students

Insights and Events

Student Research Community

Sign Up For Offers

Business Book Club

Blog

Webinars

All Educator Resources

Pearson eTextbooks

Find Teaching Resources

Digital Learning Platforms

Print & eTextbooks

Online Learning Units

Simulations

MyVirtuals

Beyond Labz

Featured products

Business disciplines

STEM disciplines

Law (UK)

Psychology

Explore Discipline Resources

Help for University Educators​

Support for Bookstores & Businesses​

Digital Platforms​ Training & Support

Find my Rep

 Higher Education Blog

News & Policy

Arts

Business & Economics 

Careers & Trades

Communication

Computer Science & IT

Engineering

English

Health

Helping Professions

Humanities

Languages

Mathematics

Nursing

Personal & Professional Development

Science

Social Sciences

Statistics

Teacher Education

Higher Education Subject Catalogue

Help for HE Students

Help for HE Educators

HE Help for Businesses

Help for FE Colleges

Support

Teach

Products & Services

Learn

Educators

Parents & Learners

Professional Development

 Pearson TQ - Custom Training

Workforce Skills Solutions

Learners

Learn & Connect 

For Learning Providers

For Employers

For Employees

Qualifications Support​

Resources Support​

Contact Us​

All School Support

All Work Support

Schools Support

College & University Support

Work Support

Global Rights Licensing

Global Permissions

investigating-the-cyber-breach-the-digital-forensics-guide-for-the-network-engineer

Investigating the Cyber Breach: The Digital Forensics Guide for the Network Engineer, 1st edition