Collecting evidence and using this in an internal investigation (disciplinary hearing) or in an external investigation (criminal proceedings) is dependent on actually identifying that an intrusion has occurred.
By the end of this section, readers should be able to analyze data from a range of security platforms and identify an intrusion. This includes filtering and grouping information from network logs, and a range of security software packages, to identify patterns indicating an anomaly, and to use these in combination to specify the key threat and/or vulnerability that these could indicate.
The following chapters are included in this section:
- Chapter 4, Identifying Rogue Data from a Dataset
- Chapter 5, Warning Signs from Network Data
- Chapter 6, Network Security Data Analysis
