COMPUTER HACKING FORENSIC INVESTIGATOR.pptx

tt

1. COMPUTER HACKING FORENSIC INVESTIGATOR (C|HFI) Name: LAMA BINRSHOUD ENG. MOHAMED SALEM

2. TASKS WIRESHARK CrowdStrike IDS & IPS

3. WIRESHARK

4. Causes of Incidents Related to CrowdStrike   Cyber Attacks: (Malware) Infiltration by viruses or Trojans. Advanced Persistent Threats (APTs): Targeted attacks by sophisticated groups. Employee Error: (Unsafe Behavior) Opening suspicious emails or visiting untrusted sites. Policy Non-Compliance: Ignoring established security protocols. Technical Vulnerabilities: (Lack of Updates) Not installing security patches. Software Flaws: Known vulnerabilities in used software. Social Engineering: (Phishing) Deceptive tactics to obtain sensitive information. Identity Management Issues: (Weak Authentication) Inadequate password practices or lack of MFA. Misconfigurations: (Insufficient Security Settings) Poorly configured firewalls or monitoring systems.

5. Training and Awareness: Train employees on cybersecurity best practices. Organize regular workshops on recognizing attacks. System and Software Updates: Ensure all systems and applications are regularly updated. Enhanced Network Monitoring: Use tools for continuous network monitoring to detect unusual activities. Implement an Intrusion Detection System (IDS). Vulnerability Assessments: Conduct regular vulnerability assessments of systems. Perform penetration testing to uncover flaws. Mechanisms to Prevents Future Incidents

6. Security Policy Implementation: Establish clear cybersecurity policies and enforce them strictly. Use Multi-Factor Authentication (MFA) for access to sensitive systems. Backup Strategies: E nsure reliable backups are in place and updated regularly. Regularly test restoration processes. Mechanisms to Prevents Future Incidents

7. IDS VS IPS IDS IDS are detection and monitoring tool. These tools don ’ t take action on their own. IDS requires a human or another system to look at the results. IPS IPS is a control system. The control system accepts and rejects a packets based on the rulesets. IPS requires that the database gets regularly updated with new threat data. Both read network packets and compare the contents to a database of known threats.