Using Attack Graphs in Forensic Examinations

576KB | 3 files |  DOC, PDF

Attack graphs are used to compute potential attack paths from a system configuration and known vulnerabilities of a system.

Abstract-attack graphs are used to compute potential attack paths from a system configuration and known vulnerabilities of a system. Attack graphs can be used to determine known vulnerability sequences that were exploited to launch the attacks and help forensic examiners in identifying many potential attack paths. After an attack happens, forensic analysis, including linking evidence with attacks, helps further understand and refine the attack scenario that was launched. Given that there are anti-forensic tools that can obfuscate, minimize or eliminate attack footprints, forensic analysis becomes harder. As a solution, the authors propose to apply attack graph to forensic analysis. They do so by including anti-forensic capabilities into attack graphs, so that the missing evidence can be explained by using longer attack paths that erase potential evidence. The authors show this capability in an explicit case study involving a Database attack.

The attached zip file includes:

  • Intro Page.pdf
  • Terms and Conditions.pdf
  • UsingAttackGraphs.pdf
IT Downloads help you save time and money while executing essential IT management tasks. Download this useful resource now and put it to work for your business.
Related IT Downloads

Security73 Guide to Application Whitelisting

This publication is intended to assist organizations in understanding the basics of application whitelisting. It also explains planning and implementation for whitelisting technologies throughout the security deployment lifecycle. ...  More >>

Security29 Security of Interactive and Automated Access Management Using Secure Shell (SSH)

This publication assists organizations in understanding the basics of SSH interactive and automated access management in an enterprise, focusing on the management of SSH user keys. ...  More >>

Security35.jpg Secrets: Managing Information Assets in the Age of Cyberespionage

In this excerpt, Pooley focuses on managing your information assets, specifically looking at how to keep them safe, stay out of trouble, and maximize their utility in your business. ...  More >>

Subscribe to our Newsletters

Sign up now and get the best business technology insights direct to your inbox.