Before we can delve into the world of conducting router and switch forensics on Cisco devices,
we need to discuss what makes a network secure. Thirty years ago we were using mainframe computers
and “security” meant nothing more than the fact that a physical wall separated the people who
worked with the data from the machines storing that data. As PCs and local area networks (LANs)
have gained acceptance over the years, securing data and resources has become more difficult. Routers
and switches are the devices that join PCs on a LAN and that join LANs over the Internet. Since
Cisco is one of the market leaders in supplying these devices, its products have become the targets of
miscreants who are attempting to break into companies’ secure networks. By reading this book, you
will learn how to recognize an incident (breach), how to gather evidence of the incident, how to get
the appropriate local, state, or federal agencies involved, and how to present your case.
In this introduction, we will discuss secure network design and Cisco’s role in router and switch
forensics. We will also discuss the equipment we’ll be using for the examples in the book, as well as
introduce the incident that we will investigate. In later chapters, we will discuss what it takes to set up
routers and switches.