🏠 Home BlogXGitHub📚 Buy Me a Book📧 Contact
Edit

Intro to Defensive Security

tryhackme.com - © TryHackMe

Name

🌐 Introduction to Defensive Security - TryHackMe Module

Description

📝 Learn Defensive Security by using digital forensics in an investigation and applying security operations to stop a live cyber attack.

  • Analyze digital evidence with digital forensics

  • Security Operations in the cyber industry

  • Learn how protection works in a web-base simulation

Intro to Digital Forensics

📝 Learn about digital forensics and related processes and experiment with a practical example

A new field of forensics (the science of crime investigations) called digital forensics was born to examine crimes involving the usage of digital technologies like:

  • desktop computers, laptops

  • smartphones, digital cameras

  • digital media (CDs, USB drives, external storage)

  • etc

The purpose of digital forensics is the use of computer science to investigate digital data/evidence for a legal purpose.

  • Public sector investigations - conducted by government and low enforcement agencies

  • Private sector investigations - conducted by corporate bodies with the help of a private investigator

The Process

After obtaining the proper legal authorization, a digital forensics investigator should:

  • acquire the evidence - collecting the digital devices (using special handling if turned on)

  • establish a chain of custody - fill out a form ensuring only authorized access to and handling of the evidence (NIST Sample form)

  • secure the evidence in a container - to avoid damage or remote wiping (via network connection)

  • transport the evidence to the digital forensics laboratory

In the lab, the digital evidence must be retrieved from the secure container and copied using advanced validated software and tools to prevent altering the original data. The investigation will be done on the identical copy using a forensics workstation. The findings can be reproduced (repeatability).

A report detailing the obtained evidence for the case concludes the digital forensics investigation.

Practical Example

❗Everything we do on our digital devices, from smartphones to computers, leaves traces.

Doc Metadata

  • Check doc files for metadata information

pdfinfo

Reveal Flag - Author of the attached PDF file: 🚩

Ann Gree Shepherd

Photo EXIF Data

EXIF (Exchangeable Image File format) is a standard for image files metadata, embedded in the image, e.g. :

  • Camera model

  • Date/Time of image capture

  • Photo settings

  • GPS coordinates of the place of capture

exiftool

  • Search for the GPS Position 51° 30' 51.90" N, 0° 5' 38.73" W (deg = °) on Google Maps.

Reveal Flag - Name of the street: 🚩

Milk Street

Reveal Flag - Camera model name: 🚩

Canon EOS R6

Security Operations

📝 Learn about Security Operations Center (SOC): its responsibilities, services, and data sources

PreviousCyber Threat IntelligenceNextJuice Shop

Last updated

Was this helpful?