NWIT 264 - Network and Cloud Forensics

Focuses on the technical aspects of network and cloud intrusions and discusses the methodology commonly used by attackers. The course begins with an overview of networking protocols and then addresses topics, such as session hijacking, capturing network traffic, and the importance of collecting volatile data from on-premise and/or cloud-hosted environments. Students learn how to examine a compromised server or workstation in the field to obtain log files and forensic images of hard disk drives. Students examine server log files and forensic artifacts for evidence of the attacker’s methods and activities. PREREQUISITE(S): NWIT 151 or NWIT 170 or consent of department. Three hours lecture each week.

3 semester hours

Course Outcomes:
Upon course completion, a student will be able to:

Demonstrate an understanding of common tool knowledge and hash sets.
Perform host enumeration and port and vulnerability scanning.
Create snapshot to triage and/or image powered-on computer systems.
Describe file sharing and vulnerabilities.
Describe variety of network and cloud attacks.
Perform incident response techniques and considerations.
Analyze the scope of cloud forensics.
Analyze the future challenges and potential issues in cloud computing and network forensics.

View Schedule of Classes