Network Forensics
Computer Science: OCR GCSE, topic 1.4.13
Network Forensics
Some users of a network may intentionally or unintentionally break the network policy. The network administrator must look for times when this happens.
Network forensics
- Network administrators must capture, store, and analyse network data to discover the source of security attacks and vulnerabilities.
How is network forensics done?
- Network forensics makes use of a lot of automated software which can alert administrators to suspicious activity on the network.
- For example, an administrator might be alerted if:
- A password has been entered incorrectly 5 times.
- A user has tried to install software themselves.
Improvements
- After a security attack or vulnerability has been detected, the administrator will analyse what allowed the attack to happen.
- The administrator can then make the necessary changes to the network to prevent similar attacks in the future.
Test yourself on Network Forensics
What is one purpose of automated software that network administrators use?
What happens if a user breaks network policy?
What is the main reason that network administrators analyse data from past cyberattacks?