Overview

This course covers the tools, technology, and processes required to integrate network evidence sources into your investigations, with a focus on efficiency and effectiveness. You will leave this week with a well-stocked toolbox and the knowledge to use it on your first day back on the job. We will cover the full spectrum of network evidence, including high-level NetFlow analysis, low-level pcap exploration, ancillary network log examination, and more. We cover how to leverage existing infrastructure devices that may contain months or years of valuable evidence as well as how to place new collection platforms while an incident is already under way.

Learning Outcome

The course covers the following:
  • Extract files from network packet captures and proxy cache files, allowing follow-on malware analysis or definitive data loss determinations
  • Use historical NetFlow data to identify relevant past network occurrences, allowing accurate incident scoping
  • Reverse engineer custom network protocols to identify an attacker's command-and-control abilities and actions
  • Decrypt captured SSL traffic to identify attackers' actions and what data they extracted from the victim
  • Use data from typical network protocols to increase the fidelity of the investigation's findings
  • Identify opportunities to collect additional evidence based on the existing systems and platforms within a network architecture
  • Examine traffic using common network protocols to identify patterns of activity or specific actions that warrant further investigation
  • Incorporate log data into a comprehensive analytic process, filling knowledge gaps that may be far in the past
  • Learn how attackers leverage man-in-the-middle tools to intercept seemingly secure communications
  • Examine proprietary network protocols to determine what actions occurred on the endpoint systems
  • Analyze wireless network traffic to find evidence of malicious activity
  • Learn how to modify configuration on typical network devices such as firewalls and intrusion detection systems to increase the intelligence value of their logs and alerts during an investigation
  • Apply the knowledge you acquire during the week in a full-day capstone lab, modeled after real-world nation-state intrusions and threat actors

Who should Attend?

  • Incident response team members and forensicators who are expanding their investigative scope from endpoint systems to the network
  • Hunt team members who proactively seek adversaries already in their network environments through leveraging new intelligence against previously-collected evidence
  • Law enforcement officers, federal agents, and detectives who want to become network forensic subject matter experts
  • Security Operations Center (SOC) personnel and information security practitioners who support hunt operations, seeking to identify attackers in their network environments
  • Network defenders who are taking on added investigative and/or incident response workloads
  • Information security managers who need to understand network forensics in order to manage risk, convey information security implications, and manage investigative teams
  • Network engineers who are proactively orienting their networks to best meet investigative requirements
  • Information technology professionals who want to learn how network investigations take place
  • Anyone interested in computer network intrusions and investigations who has a solid background in computer forensics, information systems, and information security
This course is endorsed under Critical Infocomm Technology Resource Programme Plus (CITREP+) Programme.
To find out more about CITREP+ Funding, please refer to Programme Support under CITREP+ page


Information as accurate as of 24 December 2019