This means that a forensic expert must understand how the network works and how to access logged data. Monitoring for insider and outsider attacks should be a proactive activity, but many attacks may ...