What are the current views on networking with regards to gathering of forensic data over a network, and forensic...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
analysis of network activity?
Forensic analysis of network data allows investigators to reconstruct network activity during a particular period of time. These techniques are commonly used to investigate individuals suspected of crimes and to reconstruct the sequence of events that took place during a network-based information security incident.
There are many network forensic analysis tools you can use, several of which may already be present on your network. Here's a rundown of some of the most common network forensic analysis tools:
- Intrusion detection systems (IDS) offer a security-based perspective on network activity. They monitor the network for suspicious traffic and alert administrators when such traffic occurs. The records generated by an IDS play a valuable role when reconstructing a security incident.
- Packet capture tools allow you to record every bit that travels on your network or to limit the data captured so only data that has particular connection characteristics (such as 'to' or 'from' a specific system) is allowed. Due to the large volume of data generated by these tools in a short period of time, it's not feasible to retain packet capture data for an extended length of time.
- A NetFlow data collector records data on each network connection passing through the monitored device(s). This data includes the source, destination and volume of data passed. While it's not possible to preserve packet flows for an extended period of time, NetFlow data may be preserved for a longer period as it only contains summary data about each connection.
These three tools are commonly available on most networks and provide an excellent starting point for a network forensic investigation.
Dig Deeper on Monitoring Network Traffic and Network Forensics
Related Q&A from Mike Chapple
Encrypting data going to the cloud is a security best practice, but does it add extra challenges for regulators that might need to access the data? ...continue reading
Merchants that sell at off-site venues need to take extra care to follow PCI compliance standards. Expert Mike Chapple discusses how organizations ...continue reading
The FTC's order for PCI DSS compliance assessments is odd since PCI isn't a government regulation. Expert Mike Chapple explains the motivation ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.