We hope the information discussed in this class will provide attendees with enough information to survive internal or external computer security audits. This course is for system administrators and auditors who are familiar with the technical details of system administration tasks. This is the key class to understanding what to look for on a computer system and how to do it. The course material builds on the system-specific information from the second half of the Understanding and Auditing Information Systems course to really drill down into critical security elements of operating systems. The student will also learn the fundamentals of forensics - what to do when you find something that requires further investigation during an audit.
Forensic investigation plays a major role in the identification phase of computer incident handling.
To the extent possible, the focus of the forensics aspect of the course is based on the commands supplied by the operating system to investigate a potential compromise. This course points out the limitations of that approach, and suggests creating alternative toolkits. 6 SCEU Credits Auditing your system is crucial for maintaining good site security, and auditing it every day is the best way to check potential problems before they become real intrusions. We will look at a number of security auditing tasks, and present Perl scripts that you can use and modify to accomplish your own site audit portfolio. Little to no Perl expertise is required, as we will be explaining all the examples in detail.