During a recent investigation, CERT Intrinsec encountered an issue where Fortinet FSSO logs were wrongfully attributing a username/IP address to malicious trafic inside the company's network while the initiating connection was performed through the VPN.
This article aims to warn you about this issue, as to not blindfully trust FortiGate logs during your digital forensics ...
Subscribe to Intrinsec’s news feed.
Click on “Follow” and decide if you want to get news from Intrinsec via RSS, as email newsletter, via mobile or on your personal news page.
Subscription to Intrinsec comes without risk as you can unsubscribe instantly at any time.
You can also filter the feed to your needs via topics and keywords so that you only receive the news from Intrinsec which you are really interested in. Click on the blue “Filter” button below to get started.
Title: Intrinsec