Computer Science · Grade 12 · Networks and Distributed Systems · Term 3

Network Forensics and Incident Response

Introduction to techniques for investigating network security incidents and responding to breaches.

• Ontario Curriculum Expectations
• CS.N.13
• CS.S.5

About This Topic

Network forensics and incident response teach students to investigate security incidents and manage breaches systematically. They follow the six phases of a typical plan: preparation, identification, containment, eradication, recovery, and lessons learned. Students analyze network logs, packet captures, and traffic patterns to detect anomalies like unusual data flows or unauthorized access attempts, directly addressing key questions in the Ontario Grade 12 Computer Science curriculum.

This topic fits within the Networks and Distributed Systems unit, linking to standards CS.N.13 and CS.S.5. It builds analytical skills for cybersecurity careers, where quick, evidence-based decisions prevent widespread damage. By simulating attacks, students connect abstract protocols to tangible threats, sharpening their ability to design response strategies.

Active learning excels with this content because forensic processes involve iterative analysis best practiced hands-on. When students parse real log files in teams or run mock intrusions on virtual networks, they experience the urgency and complexity of incidents, solidify phase sequences through trial and error, and gain practical confidence in tools like Wireshark.

Key Questions

1. Explain the steps involved in a typical network incident response plan.
2. Analyze how network logs and traffic analysis can aid in forensic investigations.
3. Design a basic incident response strategy for a simulated cyberattack.

Learning Objectives

• Analyze network traffic data to identify indicators of a security breach.
• Classify different types of cyberattacks based on their network footprints.
• Design a phased incident response plan for a common network intrusion scenario.
• Evaluate the effectiveness of containment strategies in limiting the spread of malware.
• Synthesize evidence from network logs and packet captures to reconstruct an attack timeline.

Before You Start

Network Fundamentals

Why: Students need a solid understanding of network protocols, IP addressing, and common network devices to interpret traffic and logs.

Operating System Basics

Why: Knowledge of file systems, processes, and system logs is essential for analyzing host-based evidence during an investigation.

Key Vocabulary

Packet Capture	A recording of network traffic data, often containing headers and payload information, used for detailed analysis of network activity.
Indicators of Compromise (IoCs)	Specific pieces of forensic data, such as IP addresses, file hashes, or domain names, that indicate a computer or network has been affected by a security incident.
Network Segmentation	The practice of dividing a computer network into smaller, isolated subnetworks to improve security and performance, crucial for containment.
Log Analysis	The process of examining system and network logs to detect suspicious activities, identify attack patterns, and gather evidence for investigations.
Chain of Custody	The documented chronological history of evidence, ensuring its integrity and admissibility in legal or disciplinary proceedings.

Watch Out for These Misconceptions

Common Misconception

Incident response begins only after confirming damage.

What to Teach Instead

Preparation and identification phases start proactively with monitoring. Role-playing drills help students practice early detection through log reviews, revealing how delays amplify risks and building habits for vigilant network oversight.

Common Misconception

Network logs instantly reveal attackers without analysis.

What to Teach Instead

Logs require filtering and correlation to uncover patterns. Hands-on parsing activities let students experiment with queries, experience the detective work involved, and correct overconfidence in raw data.

Common Misconception

Forensics ends with identifying the breach source.

What to Teach Instead

Full response includes eradication, recovery, and post-incident review. Simulations across all phases show students the complete cycle, emphasizing prevention through iterative team discussions.

Active Learning Ideas

Role-Play: Breach Response Simulation

Present a scenario of a detected intrusion via email logs. Groups assign roles for each response phase, document actions in sequence, then debrief as a class on gaps. Use free tools like sample PCAP files for evidence review.

50 min·Small Groups

Log Parsing Challenge: Anomaly Hunt

Provide anonymized network logs with planted indicators of compromise. Students use text editors or basic scripts to filter entries, identify suspicious IPs, and timeline the attack. Pairs share findings in a gallery walk.

35 min·Pairs

Wireshark Workshop: Traffic Dissection

Capture benign and simulated malicious traffic using Wireshark. In small groups, filter packets by protocol, spot odd patterns like port scans, and reconstruct the event narrative. Conclude with a report on response recommendations.

45 min·Small Groups

Plan Design: Custom Strategy Builder

Give a cyberattack scenario tied to unit content. Individuals outline a tailored response plan, incorporating log analysis steps, then peer review for completeness against the six phases.

30 min·Individual

Real-World Connections

• Cybersecurity analysts at major financial institutions like RBC or TD Bank use network forensics tools daily to investigate fraudulent transactions and potential data breaches, protecting customer assets.
• Incident response teams at cloud providers such as Amazon Web Services (AWS) or Microsoft Azure are constantly monitoring for and responding to sophisticated attacks targeting their infrastructure, ensuring service availability for millions of users.
• Government cybersecurity agencies, like Canada's Communications Security Establishment (CSE), employ network forensics to track state-sponsored cyber threats and protect critical national infrastructure.

Assessment Ideas

Quick Check

Present students with a short, anonymized log snippet from a web server. Ask them to identify one suspicious entry and explain why it might indicate an attack, referencing specific log fields.

Discussion Prompt

Facilitate a class discussion using the prompt: 'Imagine a ransomware attack has encrypted critical files. Which phase of the incident response plan (preparation, identification, containment, eradication, recovery, lessons learned) is the most challenging to execute effectively, and why?'

Exit Ticket

Provide students with a scenario: 'A user reports their computer is behaving erratically after clicking a suspicious link.' Ask them to list three immediate actions they would take to begin the incident response process, focusing on the identification and containment phases.

Frequently Asked Questions

What are the main steps in a network incident response plan?

The plan follows six phases: preparation builds tools and teams; identification detects anomalies via logs; containment isolates affected systems; eradication removes threats; recovery restores operations; lessons learned refines future responses. In Grade 12, students map these to simulated breaches, practicing with traffic data to internalize the sequence and adapt to scenarios like DDoS attacks.

How do network logs aid forensic investigations?

Logs record timestamps, IPs, ports, and payloads for reconstructing events. Students learn to grep for anomalies, correlate with traffic captures, and timeline intrusions. This reveals attack paths, such as lateral movement, essential for containment. Classroom exercises with sample Apache or firewall logs build pattern recognition skills aligned to CS.N.13.

How can active learning help students understand network forensics?

Active methods like group simulations and Wireshark labs make abstract phases concrete. Students role-play responses to mock breaches, parse real logs collaboratively, and iterate plans based on peer feedback. This fosters deeper retention of procedures, critical thinking under time pressure, and confidence in tools, far beyond passive reading.

What basic tools support Grade 12 network incident response practice?

Wireshark for packet analysis, tcpdump for captures, and ELK Stack demos for log visualization suit classroom use. Free virtual labs like those from TryHackMe provide safe breach scenarios. Students apply these to design strategies per CS.S.5, gaining hands-on experience with traffic forensics and response documentation.