Windows Forensics and Incident Recovery

Summary

Computer security incidents have several characteristics. Incidents may be local or remote, manual or automatic. The characteristics that all incidents share pertain to the nature of the exploit; specifically, was the incident a result of either poor system configuration or poor programming practices that were exploited? We've seen how incidents generally occur because of either a shortfall in programming, commonly known as a buffer overflow, or because of a lapse in computer system management and configuration control. The vulnerabilities that lead to these incidents by way of being exploited are generally publicly known, in some cases for quite a while before incidents begin to occur. The vulnerability may have been patched for several ...