You work as a security administrator of a large department store chain or choose another large corporation of your choosing. You believe that there has been a breach in the VPN where an employee has stolen data using a personal laptop along with using the company assignment computer. You review the logs from the IDS, remote access systems, and, file servers and confirm this belief.
Create a formal document to the CEO of the company to account for your findings, tools used to solve the breach and what steps will be taken to prevent this type of breach from happening again.
Things to consider: What would best be used to identify the specific laptop used for the theft? How would you acquire the identifying information? List some items that would NOT be useful to identify the specific computer used by the insider.
Sample Solution