Network Forensics and Incident Response

Course Description

Network Forensics and Incident Response examines the discovery, retrieval, and examination of forensic evidence from computer and network security breaches. It addresses incident management, malicious software examination, locating and securing intrusion proof, information concealment techniques, and recognition of attack patterns transmitted over networks. Students need foundational knowledge of network systems and the Linux operating system.

Within the SCNS taxonomy, CET is the Computer Engineering Technology prefix. Daytona State publishes this at 3 credits, offered spring, with CIS4360 as prerequisite, giving approximately 45 contact hours at the prefix's unsuffixed convention.

This course pairs two things that are usually taught separately, and the pairing is the point. Incident response is about restoring the organisation; forensics is about preserving what happened. Those goals conflict directly — the fastest way to stop an intrusion is to wipe and rebuild, which destroys the evidence of how it began and whether it is truly gone. Managing that tension deliberately, under pressure, with executives asking when systems will be back, is the actual professional skill.

Daytona State does not publish a lecture and laboratory split for its CET courses. The prefix's unsuffixed courses run consistently at 15 contact hours per credit — CET1588, CET2544, CET2691, CET2792, CET2793, CET2794, CET3505 and CET4542 are all published at 3 credits and 45 hours, without exception. Its C-suffixed courses run at 20 or above and its L-suffixed laboratories at 30. This course is unsuffixed and is priced at the unsuffixed convention.

Learning Outcomes

Required Outcomes

• Describe the incident response lifecycle and its phases.
• Describe incident classification and severity assessment.
• Describe the composition and roles of an incident response team.
• Apply an incident response plan to a described scenario.
• Describe preparation activities that make response possible.
• Detect and validate a suspected security incident.
• Apply containment strategies and describe their trade-offs.
• Balance evidence preservation against operational restoration.
• Perform eradication and describe verification of removal.
• Plan and verify recovery to normal operations.
• Conduct a post-incident review and produce lessons learned.
• Capture and analyse network traffic.
• Interpret packet captures and reconstruct sessions.
• Analyse network protocols for evidence of attack.
• Analyse log data from network devices, servers, and security tools.
• Correlate events across multiple log sources.
• Describe intrusion detection and prevention systems and their output.
• Recognise common attack patterns in network traffic.
• Describe command and control channels and their detection.
• Describe data exfiltration techniques and their indicators.
• Describe covert channels, tunnelling, and steganography.
• Perform basic static and dynamic malware examination safely.
• Describe indicators of compromise and threat intelligence.
• Document an incident and report it to technical and non-technical audiences.

Optional Outcomes

• Describe threat hunting methodology.
• Apply the MITRE ATT&CK framework to observed activity.
• Describe security orchestration and automated response.
• Describe cloud incident response considerations.
• Describe legal and regulatory reporting obligations after a breach.
• Prepare for an incident response certification.

Major Topics

Required Topics

• Incident response lifecycle
• Incident classification and severity
• Response team roles
• Incident response planning
• Preparation activities
• Detection and validation
• Containment strategies
• Evidence preservation versus restoration
• Eradication and verification
• Recovery
• Post-incident review
• Network traffic capture
• Packet analysis and session reconstruction
• Protocol analysis for attack evidence
• Log analysis
• Cross-source event correlation
• Intrusion detection and prevention
• Attack pattern recognition
• Command and control detection
• Data exfiltration indicators
• Covert channels and steganography
• Malware examination
• Indicators of compromise and threat intelligence
• Incident documentation and reporting

Optional Topics

• Threat hunting
• MITRE ATT&CK application
• Security orchestration and automation
• Cloud incident response
• Breach reporting obligations
• Certification preparation

Resources & Tools

• The programme's laboratory and its isolated network — the only place you can lawfully practise most of this. Use every scheduled hour and every open-lab hour.
• Virtualisation software — VirtualBox is free, VMware Workstation Player is free for personal use; a home lab of virtual machines costs nothing but disk space.
• Kali Linux and the SANS SIFT Workstation — free tool distributions for security testing and forensics respectively.
• Autopsy and The Sleuth Kit (sleuthkit.org) — free and open-source forensic tools used professionally, not merely for teaching.
• NIST Computer Forensics Tool Testing programme (cftt.nist.gov) — free tool validation reports; the reference when you need to defend a tool choice.
• NIST Special Publications, especially SP 800-86 (forensic techniques in incident response) and SP 800-61 (incident handling) — free, authoritative, and directly examinable.
• CISA (cisa.gov) — free advisories, guidance, and free training resources.
• MITRE ATT&CK (attack.mitre.org) — free; the standard framework for describing adversary behaviour, and increasingly expected knowledge.
• TryHackMe, Hack The Box, and OverTheWire — lawful practice environments, with free tiers; the right place to practise offensive technique.
• CompTIA and Cisco Networking Academy materials — aligned to the certifications employers ask for.
• Applied Network Security Monitoring (Sanders & Smith) — practical and directly aligned to this syllabus.
• The Practice of Network Security Monitoring (Bejtlich) — on building detection capability rather than buying it.
• Wireshark, Zeek, and Suricata — free and open-source; the professional tools for capture, analysis, and detection.
• Malware-Traffic-Analysis.net — free real packet captures with exercises; the best practice material available for this subject.
• NIST SP 800-61 — free; the computer security incident handling guide, and the reference most organisations' plans are built on.

Career Pathways

• Information security analyst — SOC 15-1212; consistently among the fastest-growing occupations.
• Computer network support specialist — SOC 15-1231; computer user support specialist — SOC 15-1232.
• Network and computer systems administrator — SOC 15-1244.
• Digital forensics examiner — in law enforcement, in corporate investigations, and in consulting firms.
• Incident responder and security operations centre analyst — a large and growing entry route into security.
• Electrical and electronics engineering technologist or technician — SOC 17-3023, for the digital design pathway.
• Embedded systems and FPGA development — a specialised, well-paid pathway from the digital design sequence.
• Florida's defence, space, and simulation sector — the Space Coast, Orlando's simulation and training cluster, and Tampa's defence presence all hire heavily in these areas, and many roles require U.S. citizenship and a security clearance.
• Public sector and law enforcement — state and county agencies, and federal offices with a large Florida presence.
• Healthcare, financial services, and hospitality IT — all large Florida sectors with substantial compliance-driven security demand.
• Consulting and managed security service providers.
• ⚠ Many security and forensics roles require a clean background — criminal history, and for cleared work significant unresolved debt or foreign contacts, can be disqualifying. Find this out before investing in the pathway.

Special Information

⚠⚠ Containment versus evidence — decide the priority before the incident, not during it

• These two goals genuinely conflict, and pretending otherwise is how both are lost. Pulling a compromised server offline stops the bleeding and destroys volatile evidence; leaving it running preserves evidence and lets the intruder continue.
• The organisation decides the priority, not the responder — and it should have decided in advance, in the incident response plan. If litigation or prosecution is contemplated, evidence weighs more heavily; if operations are critical, restoration does.
• Capture volatile data before containment where the plan allows it — memory, network connections, running processes.
• Network isolation is frequently the better containment than powering off, because it stops the activity while preserving memory.
• Do not tip off the intruder before you are ready to act; a rushed partial containment leads to accelerated damage or destroyed evidence.
• Assume the attacker is watching your response if they still have access, including your internal communications — use out-of-band channels during an active incident.
• Eradication must be verified, and incomplete eradication means the intruder returns through a persistence mechanism you did not find.
• Document decisions and their reasons as you go. Under pressure this is what is abandoned first and what is most needed afterwards.
• ⚠ Florida imposes breach notification obligations. The Florida Information Protection Act (§ 501.171, Florida Statutes) requires notification to affected individuals and, above a threshold number of individuals, to the Department of Legal Affairs, within a period specified by the statute. Sector-specific federal rules may also apply. Rule 11 applies — verify current requirements and involve counsel immediately; the notification clock is a legal exposure that technical responders routinely overlook.

⚠ Handle malware safely, and never on a production machine

• Analyse malware only in an isolated environment — a virtual machine with no network access to anything you care about, on a host you can rebuild.
• Assume the sample will attempt to escape or to detect you. Modern malware checks for virtual machines and analysis tooling and behaves differently when it finds them.
• Snapshot before execution so you can revert, and treat every snapshot after execution as contaminated.
• Static analysis first — strings, headers, imports — because it is safe and frequently tells you enough.
• Never transfer a sample onto a production system or a personal device, and never email one unencrypted.
• Be careful with public sandbox services. Uploading a sample can expose that an organisation has been breached, and in a targeted attack the adversary may be watching for exactly that.
• Extract indicators of compromise and share them through the proper channel — they are how detection improves.
• Know your limits. Deep reverse engineering is a speciality; recognising when to escalate is professional judgement, not failure.

⚠⚠ Chain of custody and admissibility — evidence you cannot defend is evidence you do not have

• The technical work is only half of digital forensics; the other half is being able to prove, later and under challenge, that what you produced is what was there. An analysis that cannot be defended in a hearing is an analysis that did not happen.
• Never work on the original. Acquire a forensic image using a hardware or software write-blocker, verify it, and work only from copies.
• Hash everything, before and after. A cryptographic hash of the source and of the image, recorded at acquisition and re-verified afterwards, is what demonstrates the data has not changed. Record the algorithm and the values in your notes, not just in the tool's log.
• Document chain of custody continuously — who had the evidence, when, where it was stored, and every transfer, signed. A single unexplained gap can exclude the evidence entirely.
• Contemporaneous notes are the deliverable. What you did, when, with which tool and version, and why. You may testify years later, and you will have only what you wrote.
• Your process must be reproducible by another examiner reaching the same result — that is what makes it a method rather than an opinion.
• Validate your tools and know their limitations; "the software said so" is not a finding you can defend.
• Report what you found, including what does not support the theory you were asked about. An examiner who reports selectively is not an expert witness, and it will be exposed.
• Stay within your competence. Testifying beyond what you can actually support is how examiners are discredited.
• ⚠ Standards for expert testimony have changed in Florida in recent years, and the admissibility of technical evidence is a live legal question. Rule 11 applies — work with counsel and verify the current standard rather than relying on this guide.

⚠⚠ Authorisation is the line between a security professional and a defendant

• Never access, scan, or test a system you do not have written permission to touch. Not a friend's network, not your employer's without authority, not a "harmless" port scan of a site you use. This is the one rule in this field that carries criminal consequences.
• Federal exposure: the Computer Fraud and Abuse Act criminalises unauthorised access to a protected computer, and "exceeding authorised access" has been read broadly.
• ⚠⚠ Florida exposure is separate and additional: the Florida Computer Crimes Act, Chapter 815, Florida Statutes, makes offences against intellectual property, computer users, and computer equipment punishable under state law independently of federal law. A student who assumes only federal law applies is wrong.
• Curiosity is not a defence, and neither is intent to help. Discovering a vulnerability and testing it without authorisation is an offence even when you meant to report it.
• Use the lab. Your programme provides an isolated environment precisely so you can practise techniques that would be unlawful elsewhere — build your own isolated lab at home too, and keep it off the production network.
• Get scope in writing before any authorised engagement — systems, addresses, times, techniques permitted, and who to contact when something breaks. A verbal "go ahead" protects nobody.
• Stay inside scope once you start. Following an interesting path onto a system not covered by the authorisation is where legitimate testers get into trouble.
• Responsible disclosure has a process. Follow the vendor's or organisation's published route, and do not publish details before it has been addressed.
• ⚠ Rule 11 applies. Computer crime, privacy, and disclosure law changes; verify current law and take advice rather than relying on a course guide.

⚠ Certifications carry real weight in this field — more than in most

• Information technology and security hire on demonstrated capability, and certifications are the common shorthand for it — frequently appearing as hard requirements in job postings and in government and contractor roles.
• Foundational: CompTIA A+ (hardware and operating systems), Network+, and Security+. Security+ in particular satisfies a widely cited U.S. Department of Defense baseline requirement, which makes it valuable in Florida's substantial defence and contractor sector.
• Networking: Cisco CCNA remains the recognised entry credential.
• Digital forensics: EnCE (EnCase), ACE (AccessData), CCE, and the SANS GCFE and GCFA. The SANS credentials are the most respected and by far the most expensive — employers frequently pay for them, so raise it at interview rather than self-funding.
• Security management: CISSP is the senior standard but requires several years of documented experience; SSCP is its practitioner-level counterpart and is reachable earlier.
• Time your certification to your coursework. Sit the examination while the material is fresh — pass rates fall sharply the longer graduates wait.
• Certifications expire. Most require continuing education and renewal, so plan for the ongoing cost.
• ⚠ A certification is not a substitute for the degree, and the degree is not a substitute for certifications. Employers in this field commonly want both, plus evidence you have actually built and broken things.
• Build a home lab and document it. Virtual machines cost nothing, and a candidate who can describe what they built and what went wrong interviews far better than one who lists courses.

How Florida course levels affect transfer

The first digit of an SCNS number denotes the year of offering, not transferability. Courses at the 1000 and 2000 levels transfer transparently between Florida public institutions, and 3000 to 4000 is unproblematic since both are upper division. The boundary that actually matters is 2000 to 3000, where lower-division credit generally cannot satisfy an upper-division requirement.

⚠ That boundary is live in this prefix. Daytona State offers CET courses at the 1000, 2000, 3000 and 4000 levels, the upper-division ones forming part of a bachelor of applied science. A 2000-level CET course does not substitute for its 3000- or 4000-level counterpart even where the subject matter overlaps — compare CET2880C/CET2881C (Data Forensics I and II, lower division) with CET4860/CET4861 (Introduction to and Advanced Digital Forensics, upper division). Confirm with an advisor which lower-division courses feed the BAS.

CET4862 is 3 credits and approximately 45 contact hours, offered spring at Daytona State, prerequisite CIS4360.

⚠ Comfort with networking and Linux is assumed, not taught. It complements CET4860 and CET4861 — those cover host and device evidence, this one covers the network and the response process around it.