Auditing a Shared Folder

Windows 7 and Server 2008 both have the feature to audit File Share. As stated by Microsoft, "This security policy setting determines whether the operating system generates audit events when a file share is accessed." We will be using this feature as other Systems Administrators do to detect if there has been intrusion. Remember that to stop the intrusion, effective firewalls are necessary.
Follow these steps to use Audit File Share:

1. Open Local Security Policy by clicking the Start button, typing secpol.msc into the search box, and then clicking secpol.‌ If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

2. In the left pane, expand the Advanced Audit Policy Configuration folder. Expand System Audit Policies - Local Group. Double-click on Object Access.

3. In the right pane double-click on Audit File Share.

4. In the Audit File Share Properties window select the Configure the following events: check box. Then select the Success check box and the Failure check box to audit both successful and unsuccessful attempts to access a shared folder. Then click OK.
   

Source: http://technet.microsoft.com/en-us/library/dd772690%28WS.10%29.aspx

NetStumbler,Cyberspace and Other Network Tools

There are many tools and utilities that can help a Network Administrator. One must know what tools are available, how to use them, and what their legal parameters are.

Stated to the point in a Wiki article (2009),

• NetStumbler (also known as Network Stumbler) is a tool for Windows that facilitates detection of Wireless LANs using the 802.11b, 802.11a and 802.11g WLAN standards. It runs on Microsoft Windows operating systems from Windows 2000 to Windows XP.
• Commonly used for:
  
  
  • Wardriving
  • Verifying network configurations
  • Finding locations with poor coverage in a WLAN
  • Detecting causes of wireless interference
  • Detecting unauthorized ("rogue") access points
  • Aiming directional antennas for long-haul WLAN links

I find that "unauthorrized ('rogue') access points" refers to access points intended for spoofing.

After searching a little on Wardriving I found that it is the act of recording and then usually mapping Wifi points. It is not piggybacking another person's or entity's network. Which is punishable by law.

Read your state laws for "breaking and entering" in cyberspace at http://www.ncsl.org/IssuesResearch/TelecommunicationsInformationTechnology/ComputerHackingandUnauthorizedAccessLaws/tabid/13494/Default.aspx

An interesting point to consider is that when wardriving with NetStumbler, there is communication between the network and you as a war-driver. Thus, there could be legal issues.
Lets look at some articles that have to do with Network tools like Nmap, Wireshark, and Netstumbler.

Preston (2001) a writer for the Journal of Law and Policy expressed many valid points in 2001, which are still valid today. He extensively cites many court cases including State vs. Allen.
And states that basic defense methods like firewalls "that [prevent] port scans but not nmap-type OS fingerprinting might establish a strong case for liability against a nmap scanner...the cost of preventing nmap-type OS fingerprinting might be found minimal; the court might assign liability only where the defendant used other means to get the information".

Cited List

• (2009).Wikipedia. Retrieved on October 30 2009 from http://en.wikipedia.org/wiki/NetStumbler
• Preston, E. (2001). Finding fences in cyberspace: privacy and open access on the internet. Journal of Law & Policy, Spring 2001, Vol 6, Issue 1,B3. Retrieved on October 30 2009 from http://grove.ufl.edu/~techlaw/vol6/issue1/preston.html

Related Links

• http://stumbler.net/
• http://www.netstumbler.com/