Digital Forensics Overview

The process of obtaining a forensically sound copy of data from an evidence device.

Ensures that information relevant to a legal case is preserved.

The principle that forensics analysis should be performed without bias and with repeatable methods.

The ability to repeat the same analysis with the same evidence and get the same results.

This refers to the scope and extent of evidence that is being collected. It's vital to understand what evidence is relevant to the case.

The process of documenting and ensuring the integrity of evidence from the moment it's collected until it's presented in court.

The process of examining and analyzing collected evidence to identify patterns, connections, and insights.

A detailed report that summarizes the findings of a digital forensic investigation. It includes the methods used, tools employed, and the conclusions drawn.

A technique used by attackers to overwhelm a target's bandwidth by sending a flood of requests from multiple sources.

A network of compromised computers (zombies) controlled by an attacker to launch attacks.

A process used by bots to communicate with the C&C (Command and Control) server and receive instructions.

A system of hosts used by attackers to direct, distribute, and control malware.

A technique used to analyze network traffic and identify malicious activity.

A method of mitigating DDoS attacks by redirecting malicious traffic to a blackhole or sinkhole.

A process of detecting suspicious beaconing activity by analyzing network sessions for patterns of malicious behavior.

A technique for blocking malicious traffic at the network level, often used as a mitigation strategy for DDoS attacks.

Attackers can embed commands within the metadata of media files like images, audio, and video, allowing them to control bots. This can be difficult to detect because security systems often overlook metadata.

Attackers can take advantage of cloud platforms, like Google App Engine, to host their command and control servers. This allows them to use the cloud provider's infrastructure for free or at low cost, making it easier to manage their botnet operations.

Attackers can use social media platforms like Twitter or LinkedIn for command and control, disguising commands as seemingly normal activities, like posting messages or hashtags.

Any unauthorized device connected to a network can be a security risk, potentially allowing attackers to gain access to sensitive information. Examples include USB drives, extra network adapters, or personal phones connected to the network.

The process of identifying and removing unauthorized devices from a network. This is crucial for network security and can help prevent attacks.

A physical device attached to network cables to intercept and record data packets passing through a specific network segment. This can be used for legitimate monitoring but can also be exploited by attackers to eavesdrop on network traffic.

The method of disguising malicious commands as legitimate data within regular network traffic, making it harder to detect attacks.

Attackers can use various techniques to conceal their command and control activities, including data hiding, social engineering, and exploiting vulnerabilities in software or hardware.

A set of best practices and guidelines for implementing IT and cybersecurity. They provide structure and a standard for organizations to achieve better cybersecurity posture.

A key component of information security that involves adhering to rules, regulations, and standards set by external bodies.

A document outlining an organization's current cybersecurity capabilities, desired goals, and prioritized investments. It helps in establishing a clear roadmap for cybersecurity improvements.

A framework that outlines activities and objectives undertaken to reduce cybersecurity risks. It aims to provide a structured approach to risk management.

ESA frameworks that prescribe specific controls and measures that must be implemented by organizations. Compliance with these frameworks is often mandatory.

A team in security exercises that attempts to penetrate the network or exploit vulnerabilities as a potential attacker.

A team in security exercises that operates the security system and defends against the Red Team's attacks.

A team in security exercises that sets the rules and objectives for the exercise. They ensure the exercise stays within safe and acceptable boundaries.

A systematic approach to regularly reviewing security posture and identifying areas for improvement. It involves analyzing incidents, threat intelligence, security controls, and compliance progress, and creating reports for continuous improvement.

An ongoing process of continuously monitoring and assessing security risks to prevent incidents before they occur.

The ability to detect security incidents after they have occurred. Examples include intrusion detection systems (IDS) and security logs.

A standardized framework for measuring and communicating the severity of software and hardware vulnerabilities. It assigns a numerical score based on factors like impact and exploitability.

The practice of identifying and implementing changes to improve security posture. This can include adding new controls, updating existing systems, or adopting new security frameworks.

The systematic process of analyzing and interpreting security events to identify patterns, trends, and potential threats. This information is used to improve security and prevent future incidents.

The process of ensuring all critical assets and risk areas are under constant surveillance. It utilizes various systems and tools to detect a wide range of security issues.

A detailed report that summarizes the findings of a security review or incident investigation. It includes analysis of threats, vulnerabilities, and recommendations for improvement.

Specifies whether a user must interact with something for the vulnerability to be exploited. 'N' means no interaction is required, while 'R' means user interaction is required.

Indicates whether an exploited vulnerability affects resources beyond the scope managed by the vulnerable component's security authority. 'U' means the impact is limited to the same authority, while 'C' means the impact extends beyond.

Describes the attacker's required privileges to exploit the vulnerability. 'N' means no privileges needed, 'L' means low privileges, and 'H' means high privileges.

Indicates the level of impact on Confidentiality, Integrity, and Availability (CIA) due to a vulnerability. 'N' means no impact, 'L' means low impact, and 'H' means high impact.

The CVSS 3.1 calculator is an online tool that helps you assess the severity of vulnerabilities based on their measured characteristics.

This metric assesses the complexity of exploiting a vulnerability. 'L' indicates low complexity, meaning the exploitation is fairly easy.

In the context of CVSS, this refers to how a vulnerability is accessed or exploited.

CVSS stands for Common Vulnerability Scoring System and is a standardized way to measure the severity of vulnerabilities.