Windows Forensics and Incident Recovery

Lowest Common Denominator

When boiled down to the lowest common factors, incidents generally occur for one of two (or possibly a combination of the two) reasons. One reason is poor configuration control of the operating system and applications on the system. Generally speaking, incidents can occur as a result of the system not being properly configured. One example of this is a weak or nonexistent Administrator password. If the Administrator password is publicly known or easily guessed, it is a relatively trivial matter to gain Administrator access to the system. This can be particularly troublesome if the system can be accessed and logged into remotely. The attacker can simply log into the system remotely using the Administrator account. Usernames ...