Re: Break-in discovery and forensics tools

["Steve Manzuik" <steve () entrenchtech com>]

> I realize the importance of after incident forensics... What I dont
understand is logs used in a court for prosecution. 
> Logs are inheritly not preservable or physical evidence, it is
tamperable from the time the external data hits a MAC, if 
> that were the case basicly I could take my logs and edit any damn
originating ip i choose, send thosse logs to law 
> enforcement, and have an innocent person convicted. Logs are nice..
but IMHO defeatable in court.

It would be quite simple for an attacker to modify or delete the logs on
most operating systems.  That being said, some organizations take steps
to protect the integrity of their logs.  A central syslog server is
typically used and in some cases I have even seen logfiles on that
central server digitally signed, encrypted and stored on some sort of
write once/read only (ie: CDR) media.  I have even seen some go as far
as tunneling this traffic over SSH.



I've stopped 316 spam messages. You can too!
Get your free, safe spam protection at
http://www.cloudmark.com/spamnetsig/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html