Security Engineering · Cluster
Incident Response
Detection, containment, and forensics.
- 01 Process Start Records as the Unit of Execution Evidence Why the parent-child relationship and process start time are the two facts an investigation needs first, what records the kernel actually keeps, and where those records disappear.
- 02 Clock Skew and the Limits of Cross-Host Event Ordering Where host clocks diverge, how much error an unsynchronized timeline carries, and which ordering conclusions survive when timestamps from different machines are merged.
- 03 Disk Image Integrity and Chain of Custody Mechanics What a hash establishes about a disk image, why acquisition order determines what the image can prove, and how write blockers and hashing after the fact differ in evidentiary value.
- 04 Containment Through Network Isolation at the Packet Layer Why disabling an account does not stop an intrusion, and how switch port filters, ACLs, and quarantine VLANs differ in what they actually block.
- 05 What Live Memory Acquisition Changes While It Reads Why the act of capturing physical memory alters the state being captured, which artifacts survive the read, and the ordering rules that follow from the perturbation.
- 06 Behavioral Detection versus Indicator Matching in Alert Pipelines How signature rules and behavioral rules differ in what they can express, why indicator matching decays, and what the cost of a rule is in false positives per unit of signal.
- 07 Log Destruction, Rotation, and the Gaps It Leaves Behind Which logs an intruder with privilege can erase, which records survive in the kernel and on remote collectors, and how absence of evidence is distinguished from evidence of absence.
- 08 Filesystem Timestamps and Why Timestomping Leaves a Seam Which timestamps an application can set, which only the kernel writes, and how the divergence between them exposes an attempt to backdate a file.
- 09 Recovering Hidden Processes from a Physical Memory Image How the kernel links processes in several independent structures, why unlinking from one is insufficient, and the scan strategies that recover what the lists no longer contain.
- 10 Lateral Movement Inferred from Authentication Records How a domain authentication log encodes the machine a logon came from, why that field is forgeable, and which patterns distinguish traversal from ordinary administration.