GNFA · Domain 4
Commercial Network Forensics
About 25% of the exam
Cloud evidence sources
- Flow logs
- metadata for each interface conversation
- Traffic mirroring
- full packets from an instance interface
- Control plane audit
- who changed which resource
- Resolver query logs
- name lookups from inside the network
- Load balancer logs
- client address, path, response
- Storage access logs
- object reads, writes and requester
Flow logs answer who talked; mirroring answers what was said; audit logs answer who changed the plumbing
Shared responsibility
- The provider owns the physical layer
- The customer owns configuration and data
- No hardware seizure, no write blocker
- Logging must be enabled before the incident
- Provider data needs formal legal process
- Region choice can change the applicable law
Cloud attack paths
- Stolen keys used for rapid enumeration
- Role chaining across linked accounts
- Security group opened to the world
- Private connectivity to attacker infrastructure
- Detector disabled just before the activity
- Storage made public then bulk copied
Preserving cloud evidence
- Snapshot volumes
- Capture instance memory
- Export the logs
- Copy to an isolated account
- Hash the exports
- Record the collection method
Centralize logs into an account the workload administrators cannot touch, or an attacker with admin rights erases them
Cloud network visibility gaps
Bypass paths
- Private endpoints skip the internet gateway
- Peering carries traffic around inspection
- Service mesh keeps calls inside the cluster
- Serverless functions leave no host
What still records
- Control plane calls with identity
- Sidecar proxy access logs
- Function invocation logs with request identifiers
- Storage and database access logs
Correlation moves
- Interface address back to the instance
- Instance back to the launching principal
- Principal to the assumed role chain
- Request identifier across services
Commercial capture platforms
- Appliances index packets for fast retrieval
- Retention tiers age packets into metadata
- Session reconstruction built into the console
- Break and inspect adds decrypted visibility
- Certificate pinning breaks interception
- Validate vendor parsing before relying on it
Proxy and gateway logs
- Authenticated user
- ties the session to a person
- Full path
- more than the hostname alone
- Category and verdict
- why the request was allowed
- Bytes in and out
- sizing for exfiltration questions
- Agent string
- tool or browser making requests
- Decryption failure
- pinning, non standard protocol, tunnel
Wireless capture basics
- Monitor mode
- captures management and control frames
- Radio header
- signal strength, channel and rate
- Beacon frame
- network name and capabilities advertised
- Security element
- authentication and cipher suites offered
- Four way handshake
- session keys derived, crackable offline
- Key identifier capture
- offline attack without a client
- Channel hopping
- coverage traded against completeness
Wireless attacks to recognize
- Rogue access point impersonating the corporate network
- Deauthentication flood forcing reconnection
- Key reinstallation forcing nonce reuse
- Address filtering bypassed by spoofing
- Authentication downgrade to a weaker method
- Jamming as denial of service
Modern key exchange resists offline dictionary attacks, which is why the older handshake capture matters so much
Encrypted traffic in managed networks
What you keep
- Client and server fingerprints
- Certificate subject and issuer
- Session timing and volume
- Destination reputation and hosting
What you lose
- Payload without an interception point
- Hostname when the hello is encrypted
- Lookups when the resolver is encrypted
- Content under pinned applications
How to compensate
- Log session keys on managed endpoints
- Terminate at an inspecting proxy
- Pull endpoint process to connection telemetry
- Correlate volume with staging on the host
Legal process and jurisdiction
- Provider records need a formal request
- Preservation letters stop routine deletion
- Cross border data may need treaty channels
- Replicated regions add another legal regime
- Multi tenant storage complicates scope
- Ask only for the relevant period
Readiness before the incident
- Enable flow and audit logging everywhere
- Centralize into immutable storage
- Pre stage snapshot and isolation runbooks
- Deploy memory collection agents in the image
- Test the export path quarterly
- Document retention for every log source
Rapid recall
- Flow log
- cloud metadata, no payload
- Mirroring
- cloud full packet copy
- Audit log
- identity behind each configuration change
- Principal
- the identity that made the call
- Role assumption
- temporary credentials from a trust
- Immutable store
- write once, administrator cannot delete
Know the order
- Confirm logging is on
- Preserve volatile instance state
- Snapshot storage
- Export logs to isolation
- Correlate identity and network
- Request provider records
In the cloud, preservation is an interface call, so scope and authority must be settled before you click
Reference strip: cloud and wireless
Cloud network logs
- Interface flow records
- Traffic mirroring sessions
- Resolver query logging
- Load balancer and gateway logs
Cloud identity trail
- Control plane audit records
- Role assumption chains
- Key usage and source addresses
- Configuration change events
Wireless frames
- Beacon, probe and association
- Deauthentication and disassociation
- Four way handshake messages
- Radio metadata header fields
Wireless risks
- Rogue and evil twin access points
- Handshake capture and offline cracking
- Key reinstallation and nonce reuse
- Address spoofing past filters
Commercial platform checks
- Indexing and retention tiers
- Decryption coverage and exceptions
- Parser validation against raw packets
- Export format for evidence handling
Quick exam traps
- Trap: Cloud flow logs contain packet payloads
- Trap: The customer can seize the underlying storage hardware
- Trap: Enabling logging after the incident recovers past activity
- Trap: Peering and private endpoints appear in perimeter monitoring
- Trap: Enterprise wireless keys can be recovered from a captured handshake
- Trap: Address filtering is an effective wireless control
- Trap: A vendor console log needs no independent validation
cybercertprep.com · original revision sheet written from the public body of knowledge