opinions wanted (computer forensics)
 

My son has just started a computer forensics degree and has just finished his first asignment ,i understand little of this ,so i wondered if any of the techies on CF would care to give their opinion .I actually found it an interesting read for a not so techie person

http://www.cableforum.co.uk/board/at...1&d=1297190948

Re: opinions wanted (computer forensics)
 

A question on the non-technical side.

He has put a bibliography at the end - is this to show his depth/width of background reading, or is it to cross-reference his sources (if so, which referencing system has he been requested to use)?

Re: opinions wanted (computer forensics)
 

I did ask what were the sources and have they been verified as accurate before he used them and basically the bibliography is to show what his sources were and what he has used as research and also to give credit to the people who wrote them as most are copyrighted ,he was told to use the Harvard system for referencing ,whatever that means ,he seems to know but it's straight over a window fitters head ;)

Re: opinions wanted (computer forensics)
 

He probably needs to read up on the usage of Harvard Referencing (or ask one of the Uni Library staff to explain it).

If it helps, here's an example of Harvard Referencing (from an essay I wrote last year.....)

In the document textIn the Bibliography You put a short reference to the source author/book/web page/article in brackets next to the quote/reference, and then the full title/year/date accessed in the references section.

Hope this helps.

btw, I notice he had put wikipedia as one of his sources - he probably needs to check if this is acceptable at his institution.

Re: opinions wanted (computer forensics)
 

Thanks for the advice Hugh i will get him to check on the use of wiki and have another look at the referencing :tu:

I suppose that the use of wiki depends on their source which is usually listed at the bottom of the page

Re: opinions wanted (computer forensics)
 

The but about MAC computers doesn't make sense, anything on a network will have a MAC address.

Also the bit below doesn't make sense to me...

Re: opinions wanted (computer forensics)
 

He means Dynamic IP addressing in that bit about static...looks like he's got confused :)

And he's spelt "Abstract" as "Abbstract" in the first page :)

Computery people will pick up stuff like that and get marked down for not using spell-check :)

Re: opinions wanted (computer forensics)
 

As gazzae states there are a few bits that need amending. Something that could also look good is if he mentioned that the Stuxnet worm used digitally signed files, maybe explain a bit about digital signatures and there uses.
Maybe also state to change the SSID to a unique name, and change the default passwords
He could also expand on the way Anon use DDoS by mentioning the Low Orbit Ion Canon and how this floods a server with hundreds of data packets thus causing it to crash.
Also at the start 2.Introduction should be "without authorisation"

p.s. Forgot to say nice read, well done to the lad...

Re: opinions wanted (computer forensics)
 

also - "unauthorized" is actually "unauthorised" but spell check wouldn't pick that up, because it's the american spelling :)

---------- Post added at 12:01 ---------- Previous post was at 11:57 ----------

Also - on a bit of an addition, he hasn't mentioned NAT (Network Address Translation) in the bit about unauthorised network access part... NAT is important as it separates external IP's from Internal IPs and is a security feature also.

A company that doesn't use NAT, may give each PC an externally accessible IP address, whereas with NAT, you only need one (or a few) external IP addresses, and so all company computers aren't as easily hacked into.

Re: opinions wanted (computer forensics)
 

There also seems to be a bit of a mismatch between the Introduction which mentions
Yet the relevant section talks more about "wardriving" which is suggests passers-by accessing the company wifi rather than employees which is a differant subject altogether. Providing strong encryption and access control will inhibit the wardriver but not stop illegal activity from employees who ARE authorised to use it. . I would mention tools to monitor employees access (Ironport being one example) in this section.

Could also do with some of the technical info being tightened up as mentioned about re: MAC addresses and SSID is not strictly the same as a Network name - but that may be just being pedantic! Also talks quite a bit about WEP but little on WPA which is also heavily used.

Not a bad read though!!

Re: opinions wanted (computer forensics)
 

He needs to correct this ;

He seems to be confusing Mac Computers with MAC addresses and filtering - the two "Macs" are not related. One is a brand of PC, the other is low level Network addressing.

Re: opinions wanted (computer forensics)
 

Modified to be technically correct using his own wording :

To prevent unauthorised access to the wireless network firstly the wireless encryption type should be changed to more secure types such as WPA2 or WPA. These are more secure than outdated WEP

PSK is not a completely different encryption type which the quoted statement would imply. PSK (pre-shared key) defines how the WPA key itself is distributed. Without going into the complexities of encryption types and radius servers it would be simpler and correct to state WPA2(PSK) or WPA(PSK) using either TKIP or AES encryption.

Re: opinions wanted (computer forensics)
 

Just general feedback,

He talks about the use of aircrack for WEP and WAP-PSK, then goes on to say the use of WPA_PSK.

'To prevent unauthorized access to the wireless network firstly the password should be changed to more secure types such as PSK, WPA2 or WPA. This is more reliable then outdated WEP.'

Emphasis is mine.

I think he needs to be clear that aircrack is only good against WPA-PSK where the key is short and a dictionary word. The use of long keys with random letters, numbers and symbols effectively stops the use of aircrack to break the WPA-PSK encryption.

Not totally sure but for WPA it only uses a brute force dictionary attack I think.

HTH

JJ

Re: opinions wanted (computer forensics)
 

Many thanks guys ,there is some good constructive feedback ,i will get him to read through the posts when he gets in from college