Investigating digital finger-prints: advanced log analysis

摘要

Perhaps your organisation has recently suffered a data breach, which would not be uncommon as last year set records for information theft. For example, in 2009 the Identity Theft Resource Center reported 498 breaches that exposed over 222 million protected records. The unreported numbers traditionally have been three or more times higher. More still go undetected or ignored.rnWhen a breach takes place, the first and most obvious step in finding out where, when and how it happened would be torncheck the logs, as they are the computer's version of the official record of events. When you open the log files, whether onrnWindows via the Event Viewer or from ~*NIX's message logs, you might stop immediately to consider one pressing question: what am I looking for?