Question: In 2006, a small business was created in the financial sector. The main purpose of the business was to provide customers with a close to real-time analysis of their stock portfolios. After months of doing business, several IT Administrators began to notice subtle changes in the corporate network. Shortly after that, the CEO began calling high-level meetings, especially with marketing and finance, to determine why the company's profits for the last five months (July to December) began to take a downward spiral. This was occurring when industry-wide profit margins were easily expected to be higher and on the rise. The CEO could not understand why his company's profits were instead decreasing, and hoped to get some insight from the meeting he had called. At this point, the CEO focused on finding the part of his business process that was failing and correcting any issues.

During his meeting with Finance and Marketing, the only information presented to the CEO was that all operations and processes remained unchanged for the past year and (from charts shown below) that the number of new customers registering through their customer portal had dropped drastically for the last five months.

1
2
3

Around the same time these meetings were occurring, one network administrator at the company noticed anomalous traffic on port 80 of the Web Server on the DMZ. The edge router's logs showed that the traffic started six months ago and ended five months later. Additionally, he noticed five months ago that traffic from the Web servers to the internal application servers decreased each day, although the inbound requests on port 80 remained about the same. Finally, he noticed, that for the last four months, his Web server logs contained many http "Post" statements. followed by the Website address of one the company's main competitors. All of the post statements seemed to appear in the logs after new users would click "submit" to register. As a result, the network administrator escalated the issue.

Write a four to five (4-5) page paper in which you:

Determine your next steps chronologically in investigating this issue.

Describe the parties you would involve and the extent of their involvement.

Explain your hypothesis of what has occurred.

Analyze the software tools you would use for your investigation.

Explain and justify the timelines and sequences of your actions.