2. You are the proprietor of a digital forensics business, and you are called by
ID: 3704430 • Letter: 2
Question
2. You are the proprietor of a digital forensics business, and you are called by a chemical processing company. They have had an incident where someone has broken into their network and disrupted their operations. Their business is one in which they cannot shut down their servers for more than a few minutes at a time because they have crews working all over the world and connecting to the server. They want to make sure that they understand how it happened so they can prevent it from happening again. a. What is the first question you should ask them? b. If you cannot turn off the servers, how are you going to get an image of the data on the computer to figure out what happened? c. How are you going to verify that the image you have is a true and accurate image?Explanation / Answer
1. The first question we should require is that the configuration of the LAN that we use for the office network. This configuration involves lot of questions such as whether the LAN is configured with Dynamic IP addressing or Static IP addressing. We also need to understand the subnet masking implemented for the network. There may also be a genuine issue with the Firewall as Firewall is a program that allows whether traffic coming to the server is allowed from a specific source. This probably seems to be a Firewall problem which usually results into network breach.
2. As usually we know that there will be multiple servers or enpoints running for the site or application which will load balanced with a Traffic Factory Manager which will responsible for redirecting the request based on the Load on the servers. Through this Traffic factory Manger we can plan the maintaince operation without any downtime. Traffic Manager redirects the requests to alternate endpoints or servers when the maintainence will be going on.
3. We also know the servers or enpoints usually are configured in a web farm architecture where all the servers are the mirror copy of the others. So due to web farm architecture the servers are always in sync with each other as the same copies get copied to the other server.
Related Questions
drjack9650@gmail.com
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.