Cybersecurity
When completing the case study you must have a minimum of 3-5 outside sources cited and referenced in the paper. Your references page must be written in APA citation style.
Case Study
You are hired by JLA Enterprise to conduct a Forensic Examination after a network intrusion occurs at their corporate office. Your job is to determine the
source of the network intrusion and provide as much information regarding the attack as possible. Here are some things to consider when explaining what
happened during the network intrusion:
What time did the attack happen?
How did the hacker get into the network?
What computers were compromised?
What computers were accessed?
What data was extracted from the network?
What type of attack was conducted?
How long did the attacker have access to the network?
Is there any persistence on the network for future attacks?
You are asked to conduct a forensics examination of the network and provide a forensic report explaining what happened during the attack and what
corporate data was compromised. The report should cover the above information, as well as create a timeline that shows the attack from the initial stages of
the attack to when the data was extracted from the network.
Your submission should be about 3 to 5 pages
Sample Solution
When conducting a forensic examination after a network intrusion, it is important to take into account all the details of the attack in order to determine the source and provide as much information about the incident as possible.
The first step is to establish when the attack occurred by examining system logs for anomalies such as unexpected spikes in traffic or suspicious activity. It is also helpful to look at any external reports that may have been made (Lamptey et al., 2015). This will help narrow down an approximate timeframe so investigators can focus their efforts on events leading up to and following attack.
Once time frame has been established next step would be determining how attacker gained access which requires examining various causes including weak passwords ,unpatched software vulnerabilities, use of public networks etc. (Kumar & Jain., 2017). System administrators should also check if malicious code was inserted through malware or phishing scams as these methods are often used by attackers for gaining foothold on compromised systems .
After initial entry point has been identified it is then important identify what computers were affected during incident . Network forensics tools can be used here pinpoint nodes that were breached while tracking movements carried out over network by intruder such as which devices they accessed or data files they copied.
