Scene of the Cybercrime: Computer Forensics Handbook

Implementing Cybercrime Detection Techniques • Chapter 9 503

source of evidence in detecting and analyzing cybercrimes, whether only

attempted or successfully completed.

Note that both authentication and authorization put various kinds of barriers

or checks between users (or consumers) and the resources they seek to utilize.

Only accounting tracks what actually happens on the networks and systems it

monitors.Thus, accounting—or, more properly, auditing—is the essential activity

that closes the loop between what is supposed to happen from a security stand-

point and what actually occurs on the systems and networks to which authenti-

cation and author ...