Incident Response & Computer Forensics, Third Edition, 3rd Edition

CHAPTER  9

Network Evidence

When the prior editions of this book were published in the early 2000s, it was rare to find an organization that considered network monitoring an essential part of a good information security strategy. It was a practice one would find only in the organizations that had highly skilled Unix staff that optimized so well that the infrastructure nearly ran itself. Only then would a bored sysadmin or two spent time placing sensors on a few switches’ SPAN ports. As with nearly every topic revisited in this edition, this has ...