Windows Forensics and Incident Recovery

Perimeter Devices

Perimeter devices are those systems that populate the edges of our networks. In most cases, these systems are firewalls and routers, but switches, VPN servers, and remote access servers (RAS) may also be included. These systems are usually set up and left to run (many times with the default configuration still in place), with the administrator or network manager thinking that as long as nothing goes wrong, everything must be fine. This may not always be the case. From an external perspective, these systems are your first line of defense in protecting your internal infrastructure's servers and workstations. After all, these may be the only systems between your internal infrastructure and the Internet.

Regardless of the device, ...