There really isn't a list of court approved tools. It's more about producing forensically sound data, which means given a set of data, another investigator should be able to generate the same results, with another tool. Using a tool that has been used in court before might make it easier to prove that it produces forensically sound results, may be more familiar to the judges and attorneys, and less likely to be called into question. But it still comes down to the investigator being able to prove the results gathered using the tool are valid and reproducable. It's kind of like saying a crime scene photo will only be accepted if it was taken with a Kodak camera.

I will check with Sean and see if he has any more information on the subject.

Hope this helps,
Mike

Those shows will definitely help you prepare for the CEH exam. On the exam, they expect you to have a good working knowledge of the hacking/pentesting process and the tools used. So any experience with them will help, especially NMAP ;)

@Ronnie-Wong Fair enough. A mention was made of polarization, but that's really not important. I think the important takeaway is that QC is really a way of making a key exchange, and of knowing immediately whether there was an eavesdropper on the process. The two things that distinguish it are that immediate knowledge of whether there was eavesdropping or not and that it doesn't rely on the mathematical assumptions that underlie public key crypto.

@Sabir-Yakub99
Hi Sabir - We will soon be offering practice exams from Transcender which will include CASP. We are excited about this option for our members. We will let you know when we have the keys available.

Thanks -
Angie
angie@itpro.tv

@darryl-hughes I really wouldn't worry too much about which part of each video fits where. The exam is going to test you across the broad areas altogether and not individually by domain.

I passed my exam (the new format) primarily because of these videos. Just make sure you watch them all and understand them inside out.

@darryl-hughes Thanks for the feedback, my goal is to do the 90 days since I do work a full time job. I am looking forward to the hands-on approach, I tend to retain the information better this way. Thanks again and I appreciate the link.

If you want more "demo" check out their latest metasploit videos.

I second that CEH was great and delivered what you need for the exam

Many congratulations to you, great achievement! One of these days I'll allocate time to following in your footsteps :)

@Scott-Hyman said:

EC council test 312-49

Scott,

According to https://cert.eccouncil.org/application-process-eligibility.html, there are two possible paths for eligibility.

In order to be eligible to attempt EC-Council CEH, CHFI v8 or ECSA v8 certification examination,
candidate may opt to :

Attend Official Training
If a candidate attends an official instructor-led training (ILT), computer-based training (CBT), online live training, or academic learning, candidate is eligible to attempt the relevant EC-Council exam.

Attempt Exam without Official Training
In order to be considered for the EC-Council certification exam without attending official
training, candidate must:

Have at least two years of information security related experience.

Educational Background that reflects specialization in information security.

Remit a non-refundable eligibility application fee of USD 100.00

Submit a completed Exam Eligibility Application Form.

Purchase an official exam voucher DIRECTLY from EC-Council through www.eccouncil.org/store.aspx

The official training means an authorized training provider. ITProTV is not at this time an Official Training Provider for the EC-Council. So this would put us into the 2nd of these categories.

Your options are limited by the EC-Council's requirements. You're going to pay for the* official training* or you're going to pay for the privilege of taking the exam!

Cordially,
Ronnie Wong
Host, ITProTV

Now I have a second, more-realistic pfSense firewall configured to put in place. Since it is an Athlon 144 I've installed the AMD64 build of 2.2.2, with Gb of PC3200 RAM, and a modest 160Gb HDD. The case is much smaller at 1U, and I plan to power it with a 12VDC source for the DSATX PSU I bought. I'm staying with four interfaces (WAN, LAN, 'ADMIN', and DMZ), I could actually transfer the configuration.

It may be in-place before the presentations, I haven't quite decided the change-out date...

Syslog and event management can grow into a large topic and ultimately lead into analytics and SIEM.

The original syslog daemon is syslog on linux, but most distributions come with rsyslog theses days and is very flexible in sorting and filtering messages. But it is all through the CLI.

If you want a UI to investigate logs then again there are lots of open source tools, to get started download security onion http://blog.securityonion.net/p/securityonion.html , install into a VM and have a look at ELSA.

You can also checkout LogStash as well, but it is a more involved install.

Then there are all the commercial offerings that you can look and a few give a freemium model.

Cheers

Dan

That's very helpful @Ben-Coyle , many thanks :+1: +1:

@D.-Rogers Thaks for those - some great mindmaps there. The SANS poster is pretty good for showing potential attack vectors to people too :+1:

I've not looked at these in depth but this guy has put together a pretty impressive list that he calls "Forensic Challenges."

http://www.amanhardikar.com/mindmaps/ForensicChallenges.html

I used a combination of self-study and on-the-job experience. I've been working in IT professionally for almost 20 years and a hobbyist for nearly 30. The CEH requirement that a candidate must show two years of work experience in a security related field is warranted. I've used and still use many of the tools as a white hat blue team defender.

Steve,

Thanks for request and I will add it to our official show request list to make sure we have it tracked and are able see the interest for it in the future! Thanks for article as well, I liked it.

Cordially,
Ronnie Wong
Host, ITProTV