Senior Incident Response Analyst
Washington D.C. Metro Area
Senior Incident Response Analyst
Washington D.C. Metro Area
From 1997 to approximately 2001, I conducted penetration tests and vulnerability assessments, ranging from war-dialing through scanning and exploitation of systems and large infrastructures. I have also engaged in advanced network exploitation research, and researched biometric (thumb-print) devices from a system penetration perspective.
Beginning in 2000, I started performing incident response activities, and shortly thereafter began instructing others. I am currently involved in incident response and computer forensic analysis, and specialize in forensic analysis of Windows systems.
I have been widely published, and have articles appearing in a variety of venues, to include SecurityFocus, the Information Security Bulletin, and the Digital Investigation Journal. I am the author of "Windows Forensics and Incident Recovery", published in July 2004 by AWL, as well as the author of "Windows Forensic Analysis", published in April 2007 by Syngress/Elsevier.
I hold the CISSP certification, and an MSEE. I have a current TS clearance.
Computer forensics, specifically on Windows systems; vulnerability assessments and penetration testing; system programming on Windows systems in Perl
The changes imposed by Microsoft as a new operating system is released poses significant challenges to security professionals, and it certainly is no different for those who perform forensic analysis of these systems. Between Windows 2000, XP, and 2003, there are many differences to keep in mind with regards to where to look for evidence, and how to understand and process that information. My current interests include forensic analysis and incident response, as well as Registry and physical memory analysis.