"As a network and security specialist, you have conquered firewall settings, access control list settings, automated patch/update processes and system lock-down. What happens then, when someone gets through all your carefully conceived and implemented protections to plan a Trojan on the CEO’s laptop? (Most likely he/she downloaded some ugly code when plugging into the Internet from home).

Now you need to move into the reactive world to perform a complete audit on your entire system, a forensic examination on the laptop, watch the traffic flowing to/from that system, and find the host that appears to have remote access to the machine. This is where the skills of reconnaissance/traceback and forensics come into play.

Everyone responsible for their organisation’s network should have at least a cursory ability to trace back to a target, perform general forensic investigation procedures and complete a system audit. These ‘next generation’ skills will enhance your security knowledge by adding investigative capabilities to your already-impressive list of capabilities." - Laura