The chief information officer of an accounting firm believes sensitive data is being exposed on the local network. Which tool should the IT staff use…

A sniffer, also known as a packet analyzer or network analyzer, is a tool specifically designed to intercept, log, and analyze traffic passing over a network. To gather digital evidence of sensitive data exposure, the IT staff would deploy a sniffer to capture the raw data packets. Subsequent analysis of these captured packets would reveal the content being transmitted, its source, and its destination, thereby providing direct evidence of the security vulnerability and the nature of the exposed data.

A. Firewall: A firewall is a network security device that controls traffic based on rules; it is not primarily a tool for capturing detailed packet content for forensic analysis.

C. Antivirus: Antivirus software is designed to detect and remove malware on endpoint systems and does not monitor the content of network traffic for data leakage.

D. Packet filter: A packet filter, typically a component of a firewall, makes decisions based on packet headers (e.g., IP addresses, ports), not the data payload where sensitive information resides.

1. NIST Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response. Section 3.3.2, "Network-Based Evidence," discusses how full packet capture is a primary source of evidence for network events. It states, "Full packet capture is the most straightforward way to acquire network-based evidence... Tools that perform full packet capture are often called packet sniffers." (Page 21).

2. Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). NIST Special Publication 800-83, Guide to Malware Incident Prevention and Handling for Desktops and Laptops. While focused on malware, Section 4.2.2, "Containment," mentions using network sniffers to "determine what the malware is doing" by analyzing its network communications, illustrating the tool's function in observing data in transit. (Page 38).

3. Luttgens, J., Pepe, M., & Mandia, K. (2014). Incident Response & Computer Forensics, Third Edition. McGraw-Hill. Chapter 11, "Network Traffic Analysis," details the use of packet capture tools (sniffers) like Wireshark and tcpdump as fundamental to network forensics. The text explains that these tools are used to "capture all packets that cross a given network interface" for later analysis to understand network events. (Section: "Sources of Network Traffic," p. 346).

4. Carnegie Mellon University, Software Engineering Institute (SEI). (2002). CERT/CC Handbook for Computer Security Incident Response Teams (CSIRTs). Section 5.4, "Tools," lists network monitoring tools like sniffers as essential for an incident response team to "monitor network activity to detect attacks or to gather more information about an attack in progress." (CMU/SEI-98-HB-001, p. 5-10).