The inspector: automating the forensic investigation of infected computers presented at Virus Bulletin 2006

by John Morris (Nortel),

Tags: Security


Summary : Zero day outbreaks of bots and viruses, undetected by current AV signatures, are common
occurrences on corporate networks. When dealing with a significant outbreak of a new
threat, there are many unknowns, not the least of which are knowing what common vulnerabilities
may be allowing these systems to become infected and the malware files that have been deposited.
By automating the forensic investigation process, IT security teams can be provided this
critical information within minutes of the outbreak starting.
This presentation will cover why automated forensic investigations are needed,
what information to gather and how to gather it remotely.