Reference no: EM133234853

You are a Digital Forensics Investigator working with the Middle Georgia Cyber Forensics Consultant firm, an organization which investigates possible network intrusions and inside attacks. The firm has been contacted by the Red Ribbon Army, a defense contracting company, to help to determine if William Jones, an employee in their Research and Development Department, has been hacking into internal and external webservers. Dr. Gero Red, Red Ribbon Army's Cybersecurity Chief stated the Network Intrusion Detection System flagged several of Mr. Jones's actions over the last three weeks, and he believed Mr. Jones was attempting to conduct reconnaissance on the internal security of their network in preparation for a planned attack. Dr. Red stated the company's network use policy, which Mr. Jones signed, only allowed employees to check their emails, browse the internet through the Google Chrome Brower, and utilize Microsoft Office Cloud Based Software Suite. Dr. Red stated due to his concerns, he installed WireShark on Mr. Jones's computer and conducted a background packet collection of Mr. Jones's network activity last week. Dr. Red stated he was not familiar with WireShark, so he did not understand how to decipher the packet collection.

The Red Ribbon Army has requested your firm examine the packet collection file in order to determine:

If Mr. Jones was interacting with any webservers in any malicious manner.

If Mr. Jones was taking steps to mask his presence on the internet (Such as changing IP addresses frequently)

What websites Mr. Jones was interacting with.

Did Mr. Jones violate the Computer Fraud and Abuse Act in relation to his actions on their Server or in his actions on any of webserver external to their network.