Network Forensics Training in South Africa

The tendency to the cyber world, which has become a part of today's social life, is increasing day by day. The case has attracted the attention of the crime centers, though information systems have been used as a crime tool.

One of the most important aspects of the investigation of cyber-crimes is numerical evidence. One of the first words that come to mind when the information system is called is "network connections". Network connections turn into sometimes internet, local or private network and GSM networks.

With this training, the working logic of the computer and GSM networks, which are considered as the most important tools of today's information world, or by using the internet or GSM infrastructures of crime centers and by using methods such as how they commit crime, and forensic information analysis techniques for the detection of these crimes are explained.

At the end of the training, each participant will have the chance to see the processes such as incident analysis; evidence gathering, backtracking, and spoliation in the crimes committed using computer networks.

• IT Security Officers
• Supervisors, Security Experts
• Website Administrator
• Anyone who works on network infrastructure integrity

Network Forensics Concepts

• Science of Forensic Analysis and Types
• Forensic Analysis in Computer Networks

Protocol Analysis from TCP/ IP Networks

• Package, protocol concepts
• Package, protocol analysis
• Sample protocol analysis studies
• http, smtp, arp, tcp, udp, voip, h323, sip, msn,. HTTP, SIP, FTP, IMAP, POP, SMTP, TCP, UDP, IPv4, IPv6, …
• Internet traffic tracking/monitoring systems and operating logic
• Lawful interception, mass interception concepts
• How to hide/unreadable network connection
• Tunneling systems
• Encrypted tunneling systems
• Package capture and analysis tools
• tcpdump, Wireshark, snort, tshark, Argus, Kismet, Ngrep, NetworkMiner, Xplico, tcpxtract, Ntop, NetFse, tcpstat, tcpdstat, Etherape, p0, Netwitness, ...
• Identifying a network sniffer

Encrypted Traffic Analysis

• SSL, TSL analysis
• Interference in SSL traffic, reading data
• SSL traffic and HTTP (HTTPS)
• Encryption anonymity networks (TOR) analysis
• Ultrasurf Analysis

In-Depth Package Analysis

• The detection systems of intrusion and anomaly 
• Working structures
• The detection of package characteristic
• Basic differences from other security systems
• Open source IPS/ADS systems
• BroIDS
• Snort IDS
• How to develop signatures for intrusion detection systems?
• How do the intrusion detection systems bypass by malware?
• Intrusion detection systems and encrypted traffic
• Decrypting original data from captured packets
• Word-based tracking in network traffic
• Passive monitoring of application layer protocols

Hardware Components in Network Traffic Analysis

• HUB
• Switch
• Bridge
• Router
• TAP systems
• Computer Forensics Analysis of TCP/IP Protocols
• Computer Forensics Analysis for OSI II layer
• MAC addresses as an evidence
• MAC addresses and their importance in wireless networks
• ARP attacks and preventions
• Investigation of ARP attacks with ArpON and Arpwatch softwares
• Computer Forensics analysis in IP layers
• IP concept and its importance today
• New generation internet addressing system (IPv6)
• Local networks and IP addresses on the Internet
• Detection IP addresses and owners
• Accessing location information of IP addresses