Network traffic analysis for Incident Response (IR): TLS decryption
When the internet was being created, security wasn’t much of an issue. The internet (and the Arpanet before it) was primarily being used by trusted parties...
Incident response
Network traffic analysis for IR: Address resolution protocol (ARP) with Wireshark
The Address Resolution Protocol (ARP) was first defined in RFC 826. As the name suggests, it is designed to resolve IP addresses into a form usable by other...
Network traffic analysis for IR: Alternatives to Wireshark
It is almost impossible to leave a conversation with a cybersecurity professional, take an introductory networking class, or break into ethical hacking without...
Network traffic analysis for IR: Statistical analysis
Statistical analysis is one of the three main categories of analysis that can be performed on network traffic data. It provides a much more detailed analysis...
Network traffic analysis for incident response (IR): What incident responders should know about networking
In this article, we’ll discuss the various things that incident responders must know about the operation of a network and how this can help improve how...
Network traffic analysis for IR: Event-based analysis
Event-based analysis, as its name suggests, focuses on analysis of specific events that occur on the monitored network. This is accomplished by defining the...
Network traffic analysis for IR: Connection analysis
Connection analysis is the highest-level type of network analysis that is used in incident response. Rather than developing and scanning with signatures of...
Network traffic analysis for IR: Data analysis for incident response
While no incident is the same, security professionals have come to rely on pre-established procedures and best practices to help contain a security breach...
Network traffic analysis for IR: Network mapping for incident response
The concept of network mapping is not a new one. Creating network maps in the design phase of a network and updating them throughout its life cycle is a crucial...
Network traffic analysis for IR: Analyzing fileless malware
Fileless malware is malware authors’ response to traditional malware identification and analysis techniques. Many antiviruses operate by using signature-based...