CST 267 - Introduction to Computer ForensicsCredits: 3
Provides a comprehensive understanding of computer forensics and electronic discovery along with associated investigation tools and techniques. Explores computer forensic theory and focuses various forensic skills used in the Information Security profession.
Prerequisite(s): CST 266
Corequisite(s): None
Lecture Hours: 45 Lab Hours: 0
Meets MTA Requirement: None
Pass/NoCredit: No
Outcomes and Objectives 1. Describe computer forensics.
A. Examine the fundamental concepts of computer forensics and why it is not strictly a technology based pursuit.
B. Study real world examples of how computer forensics is integral in investigating computer security related allegations, theft of trade secrets
and embezzlement.
C. Understand chain of custody.
D. Discuss ways to collect evidence.
E. Identify methods of evidence preservation.
F. Identify the risks involved in using an improperly trained computer forensics examiner.
G. Examine hardware and software concepts critical to the foundations of computer forensics.
2. Describe concepts of Computer Security.
A. Discuss security threats.
B. Describe the goals of information security: integrity, confidentiality and availability.
C. Discuss ramifications involved in information security, like cost and technology barriers.
D. Discuss evolving federal rules relative to information protection, identity theft, and other computer-based crimes.
3. Demonstrate applied principles of managing security measures for investigating security problems.
A. Solve problems in computer forensics investigations within the computing environment.
B. Identify and disable nonessential services.
C. Identify and disable nonessential protocols.
D. Identify and disable nonessential programs.
E. Identify and disable nonessential utilities.
F. Identify and disable nonessential processes.
G. Compare and contrast security on network media.
H. Compare and contrast security on storage media.
4. Describe various computer security risks and remedies.
A. Identify and discuss security zones.
B. Create incident responses.
C. Create security priorities profiles.
D. Transfer forensic audit procedures to protect corporate or educational assets
5. Describe the need for proper documentation.
A. Determine standards and guidelines.
B. Identify system architecture.
C. Keep logs and inventories.
D. Develop change control procedure.
E. Identify methods of documentation retention and storage.
F. Identify methods of destroying old documentation.
6. Discuss the advantages and disadvantages of cryptography.
A. Discuss integrity and confidentiality.
B. Discuss digital signatures.
C. Discuss norepudiation.
7. Demonstrate the vulnerabilities associated with computer and data
A. Discuss ethics of computer security and data mining.
B. Identify and use tools to create digital signatures.
C. Recognize and demonstrate different types of attacks associated with network use (i.e. back door attacks, spoofing attacks, TCP/IP
hijacking, etc)
8. Demonstrate knowledge of current forensics tools
A. Use various tools to test system integrity.
B. Use tools to track digital signatures.
C. Use computer forensics security configuration utilities to perform practical tasks for investigating High Performance Computing operations
D. Load and run software products as resources for identifying inappropriate cluster use.
9. Demonstrate basic fundamentals of High Performance Computing security investigation concepts.
A. Use professionally accepted investigative methods of using digital evidence control components.
B. Use cyber forensics security methodology to solve computer crimes.
C. Produce documentation of successful info security investigations.
D. Create and verify forensically sterile examination media and boot diskettes.
E. Find and recover deleted, formatted, hidden and lost data, access e-mail, cache and other internet related files.
F. Unlock passwords, convert data formats and analyze data to conclude examinations.
10. Demonstrate knowledge of High Performance Computing operating systems and boot structure.
A. Collect free space on the storage media and analyze it for signatures that would indicate data.
B. Use forensic toolkits to collect and examine data under various different operating systems environment.
C. Discuss digital similarities and differences of various operating systems (i.e. DOS, Windows, UNIX and Linux).
11: Demonstrate knowledge concerning investigating computer crime incidents.
A. Gain proficiency in the examination and preservation of info security evidence.
B. Secure compromised machines and related data.
C. Preserve and analyze evidence and consider cross border jurisdiction in international investigations.
12. Think critically and access, analyze and use information including using current Internet programming technology: formulate a question
or need, develop a strategy to meet that question or need to solve a technical problem.
A. Generate, assess and validate solutions to a security problem involving web or network access.
B. Develop and question alternative formulations of a security problem involving web or network access.
C. Search and access information via the Internet.
D. Evaluate information or data for quality, validity and bias to determine if it is objective and reliable.
E. Question assumptions, data and formulations of problems and proposed answers.
13. Think critically and access, analyze and use information including using current Internet programming technology: interpret technical
statements, texts, theories, problems, symbols and observations.
A. Clarify and analyze the meanings of technical words, phrases and statements.
B. Learn the meanings of terms and acronyms used with information security and ways to use them.
C. Generate and collect relevant observable or measurable information or data using intrusion detection software and hardware.
D. Organize and present information or data in written form.
Add to Portfolio (opens a new window)
|