All
All

Using Attack Graphs in Forensic Examinations

576KB | 3 files |  DOC, PDF

Attack graphs are used to compute potential attack paths from a system configuration and known vulnerabilities of a system.

Abstract-attack graphs are used to compute potential attack paths from a system configuration and known vulnerabilities of a system. Attack graphs can be used to determine known vulnerability sequences that were exploited to launch the attacks and help forensic examiners in identifying many potential attack paths. After an attack happens, forensic analysis, including linking evidence with attacks, helps further understand and refine the attack scenario that was launched. Given that there are anti-forensic tools that can obfuscate, minimize or eliminate attack footprints, forensic analysis becomes harder. As a solution, the authors propose to apply attack graph to forensic analysis. They do so by including anti-forensic capabilities into attack graphs, so that the missing evidence can be explained by using longer attack paths that erase potential evidence. The authors show this capability in an explicit case study involving a Database attack.

The attached zip file includes:

  • Intro Page.pdf
  • Terms and Conditions.pdf
  • UsingAttackGraphs.pdf
IT Downloads help you save time and money while executing essential IT management tasks. Download this useful resource now and put it to work for your business.
Related IT Downloads

Security28 Web Security: A WhiteHat Perspective

This excerpt from chapter 2 focuses on major browser security issues, including same-origin policy, sandboxing, malicious URL intercepts, and the continuing rapid development of security. ...  More >>

Survey03 Interfaces for Personal Identity Verification

This document contains the technical specifications to interface with the smart card to retrieve and use the PIV identity credentials. ...  More >>

Security7 Risk Management for Replication Devices

This publication provides guidance on protecting the confidentiality, integrity, and availability of information processed, stored, or transmitted on replication devices. ...  More >>

Subscribe to our Newsletters

Sign up now and get the best business technology insights direct to your inbox.


 

Thanks for your registration, follow us on our social networks to keep up-to-date