Randy's presentation was very informative, interesting, and fun. I would recommend this course and any course he teaches to others. This is the key class to understanding what to look for on a compromised computer system and how to look for it. The course material builds on the system-specific information from the second half of the Understanding and Auditing Information Systems course to really drill down into critical security elements of operating systems. The student will also learn the fundamentals of forensics - what to do when you find something that requires further investigation during an audit.
Forensic investigation plays a major role in the identification phase of computer incident handling.
To the extent possible, the focus of the forensics aspect of the course is based on the commands supplied by the operating system to investigate a potential compromise. This course points out the limitations of that approach, and suggests creating alternative toolkits. Auditing your system is crucial for maintaining good site security, and auditing it every day is the best way to check for potential problems before they become real intrusions. We will look at a number of security auditing tasks, and present Perl scripts that you can use and modify to accomplish your own site audit portfolio. Most of the examples are UNIX-centric, but the techniques presented are portable across all operating systems.