3

A technology company starts small in the early 90's and, for various reasons, blows up into a multi-million dollar company in a very short time around 2013. The problem is that this company is entirely focused on firefighting network/operations issues and expanding its services, security is only an afterthought and is rarely a priority. Now it is 2018 and in light of many high profile breaches the company decides they should make security a priority and for the first time in the company's history they dedicate a single employee whose full time job is security. The employee puts in place standards such as patch management, vulnerability scanning, stricter firewall monitoring, etc. etc. After a month in his position the employee is asked by the general manager, "So, is anybody in our network who shouldn't be?"

The question is, what are some ways the employee can use forensics to try to discover an adversary presence that will have likely existed since well before his appointment? Will the employee ever be able to do say with confidence that the network is clear of intruders, even after extensive and thorough forensic investigation?

Sorry for the lengthy explanation, just wanted to give details to help potential respondents understand the high level of probability that there is someone in already. Any words of wisdom appreciated.

  • make sure you have fiddler running all the time, logging everything for at least a week before you do any work patching. This will give you a heads up on everything that is happening. Most people tend to patch and then figure out what went wrong. Finding the problems are harder than fixing them. – DeerSpotter Aug 16 '18 at 17:44
2

If the network experiences heavy loads at off times, i.e. in the middle of the night when no one is in the office. You can see the packets on your network with some firewalls and tools like Wireshark.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.