Appropriate Risk Mitigation Strategies,Incident Response Procedures,Security Related Awareness Training

• Register, cache

• routing table, AP cache, process table, kernel statistics, memory

• Temporary file system

• Disk

• Remote logging and monitoring data that is relevant to system

• Physical configuration, network topology

• Archival media

Capture system Image : Forensic imagining program is used to create bit stream image copy of a storage device. The image copy will be stored onto a forensically clean storage device. Hash calculation of original media is performed before and after image coping is performed

Network traffic and logs : In some network environments it may be possible to maintain an ongoing recording of network traffic. Since this would result in huge storage requirement these recording will only maintain a sliding window in minutes or hours of recent network activity

Capture Video : If there are security cameras present then recording of security violation should be preserved. Another is video recording of investigation being performed to collect physical and logical evidences. Theses can be used for later reviews.

Chain of custody : The chain of custody documents that the evidence was under strict control at all times and no unauthorized person was given the opportunity to corrupt the evidence. A chain of custody includes documenting all of the serial numbers of the systems involved, who handled and had custody of the systems and for what length of time, how the computer was shipped, and any other steps in the process.

2.4 Explain the importance of security related awareness and training

Given below are some of the widely known password guessing methods:

• Dictionary: this is the method in which dictionary terms are used for guessing a password

• Birthday: It takes advantage of probabilities, much like two people in a 50-person room shared the same birthday. With every person, the chances of two people having the same birth date increases. In the same way, when you start guessing the password, the chances of a hit keep increasing.

• Brute force: In a Brute Force attack, muscle (in this case, CPU and/or network muscle) is applied to break through a particular security mechanism, rather than using particular intelligence or logic. "Brute force" is most commonly applied to password guessing, taking advantage of computer power available to an attacker, to try every possible password value, until the right one is found. In cryptography, a brute-force attack is an attempt to recover a cryptographic key or password by trying every possible combination until the correct one is found. How quickly this can be done depends on the size of the key, and the computing resources applied.

• Rainbow tables: Rainbow tables are huge lists of keys or passwords. A password-guessing program uses these lists of keys or passwords rather than generating each key or password itself.