All
right, well, let's take a look at Module
20, which deals exclusively with computer forensics.
Now, forensics, as we discussed in the
last module in incident handling response, is an extension of that process.
So if we do a full in depth forensic
investigation, there is a lot to consider in computer forensics.
As a matter of fact, this module probably
has the most information packed into it than any other module in the course.
The corresponding EC Council five day
course that goes along with forensics is the CHFI course.
I'd love to have you back for CHFI where we explore these concepts in depth.
First off, understanding computer forensics.
Forensics in general, Eric's homegrown definition.
Applying a scientific method to prove or
disprove a given set of facts or circumstances.
You'll see other definitions like the one we see on the slide that might be a little
bit more inclusive and maybe describe the process a little bit better.
Computer forensics, a set of methodological procedures and techniques
that helps to identify, gather, preserve, extract, interpret, document, and present
evidence from computing equipment such that any discovered evidence is acceptable
during a legal and or administrative proceeding.
Really important.
Admissibility is everything.
If you collect your data improperly, don't preserve chain of custody, cut corners,
take shortcuts, don't apply proper procedure, your
evidence can get thrown out of an official proceeding.
Even though you might have the suspect
dead to rights, getting them off on a technicality on the way the evidence was
acquired, that is not going to go over well.
Be sure you follow a proper procedure.
Again, good idea to come on back for CHFI where you go through the whole process.
Not only are we going to collect evidence in a scientific, repeatable, proven way,
we're going to use it to inculcate or exculcate a defendant or perpetrator to
determine whether or not a given set of facts or circumstances is correct.
What I'm driving at with that whole
discussion is that the digital evidence itself doesn't create the case.
It supports the case.
Digital evidence is considered to be quite
often secondary in nature, which is almost hearsay.
We're going to talk about that.
The very fact that you have a specific IP
address in a log file on a server doesn't mean it was actually that system that
connected to that server that compromised that system that ran an exploit.
It could have been run through a series of
proxies just because Bob's username is the owner of a file.
It doesn't mean he necessarily created it.
It may have been created under his account.
Just because Bob's IP has been identified as accessing inappropriate websites.
It could be somebody hacking into his wireless and you get the idea.
The evidence itself is going to support or not support a given hypothesis or theory.
One of the big keys to forensics is what is the question and how do I solve it?
We're going to talk a little bit more about that, but form a hypothesis on how
the circumstance can be proven or disproven.
Again, come back for CHFI.
Chfi is one of my favorite classes to teach.
I'm going to plug it here quite a bit in this course.
We just came out with version 10, which
the new lab exercise in version 10 are absolutely fantastic.
I'd love to have you back for CHFI.
You're going to get a mini CHFI course in this module for sure.
The objectives of computer forensics, to identify, gather and preserve evidence of
a cyber crime, to put it into admissible format, to communicate the results of your
findings accurately, participate in expert witness testimony, etc.
Your job as the forensic investigator is not just to be technically savvy, but be
sure you follow proper procedure to ensure that you don't get things thrown out.
That is nothing more annoying than not
collecting properly, chain of custody, or not collecting evidence at the time of
compromise and not being able to go back and collect it.
Again, we're going to talk a lot about this.
Gather evidence of cyber crimes in a forensically sound manner.
What does that mean?
Forensically sound means repeatable
sequence of steps that produce repeatable results.
I've mentioned that concept before.
That's the whole purpose of procedure.
If I follow the steps, I'll get the same
result every time, and we have higher degree of confidence in the process.
Forensically sound manner means not
tampering or taining the evidence, collecting it in a way that provides an
exact duplicate of the original, authenticating that process and using
generally accepted scientific method, tools that are generally accepted by the
scientific community, calculations, algorithms, and so forth
that are accepted by the scientific community.
We have something called the Daubert principle and the FRI standard.
That deals with your findings being backed up by scientific method.
For example, standardized hashing algorithms, standardized acquisition
tools, versus something I developed myself in my spare time.
We'll talk a bit about that.
We'll talk about our computer crime lab, our forensics crime lab considerations.
Our estimate, the potential impact of
malicious activity on the victim and assess the intent of the perpetrator.
Forensics can be used for network
troubleshooting, for administrative investigations, for civil, for criminal,
and a couple of other different categories.
But the idea here is how bad is the damage?
Is there a likelihood of more damage?
Your first and foremost consideration in all this is to prevent further damage from
being done at the time of the impact or later.
We talked about that incident response, using the review process, lessons learned
to update security and close the holes to ensure that doesn't happen again.
Minimize the tangible and intangible loss of the organization.
We talked about tangible, which is again,
the immediate ramifications of an exposure.
Intangibles are things like loss of reputation, market share, things that go
on indefinitely, which you can never really 100 % predict.
Or protecting the organization from similar incidents in the future.
That goes back hand in hand with estimate the potential impact.
And then support the prosecution of the perpetrator in an incident.
We have a couple of different types of investigations.
You have criminal, you have civil.
In criminal, your burden of proof is much higher.
You take extra precaution, follow very specific procedures.
You use brand new shrink wrap drives, etc.
However, you might be participating or at
least engaging in what's initially an administrative investigation or
operational or civil for that matter, that eventually turns criminal.
For example, let's say that you're investigating a policy violation, improper
use of internal systems, and you come across something like illegal contraband,
evidence of human trafficking, exploitation, abuse, things like that, you
are legally obligated to turn that over to law enforcement.
If you haven't taken the appropriate precautions in the initial evidence
gathering, that may lead to that evidence being inadmissible.
You always follow proper procedure.
In order to follow a proper procedure, you have to write proper procedure.
We do have some best practices and principles we're going to talk about
throughout this modulethat are put out by standardization organizations, the
American chief police officers, and the Swiggy scientific working group on digital
evidence, and the I OCE International Organization on computer evidence.
Types of cyber crimes.
Cyber crime defined as any illegal act
involving a computing device, network, its systems, or its applications.
What do we do digitally these days?
What do we not do digitally these days? Exactly.
In all likelihood, if a crime is being committed, it's being done digitally or
digital communications are going to support it.
It's pretty tough to walk around these days on planet Earth and not have a
smartphone or not have email or chat and so forth.
In general, we interact with digital
devices on a daily basis, live our lives through them.
This is your portal to the world.
Lots and lots can be tracked
through your cell phone through electronic communications.
In all likelihood, if a crime has been
committed, there's going to be at least one piece of digital evidence that's of
some value to investigate in the case, if not the smoking gun.
Our cyber crime can be categorized into two types based on the line of attack.
The internal or insider means it originates from inside the perimeter.
That's an untrusted person.
Insiders can be former or current
employees, business partners, or contractors.
The insiders come in different flavors based on intent.
They could be a malicious insider.
They could be a negligent insider.
They could be a compromised insider.
They could be a professional insider.
You may have somebody that legitimately works for the organization, but for
whatever reason, they decide maybe they're not getting what to do to them
and they help to perform an attack on the organization or they initiate themselves.
So disgruntled or malicious.
Then you have the unknowing or negligent
types of insiders who really have no idea that they're posing any harm to the
organization, but they don't follow policy.
They leave their desktop unlocked, they don't follow proper security procedures,
they haven't taken security awareness training, or they haven't followed it.
They're not necessarily malintent
or malintention, they're just negligent, maybe lazy.
Don't block their screen when they walk away from their desk, that thing.
Professional insiders make a business out of it.
They purposefully get hired on the organization with the sole objective of
selling off their access eventually to competition, Dark Web, and so forth.
Insiders can be anybody at all but inside the security perimeter.
If you're inside the security perimeter, most of your defense, your external
defense is non existent because you're already inside the perimeter.
An external attack
occurs when the attacker from outside the organization tries to gain unauthorized
access to computing systems or information assets.
These attackers exploit security loopholes
or use social engineering techniques to infiltrate network.
They originate from outside the network and they try to find their way in.
We've talked a bit about different types
of attacks, talked quite a bit about different types of attacks. social
engineering threats, so we've got a pretty good idea what that's going to look like.
The impact of cyber crimes at the organizational level, leads to loss of
confidentiality, integrity and availability.
Got it.
Theft of sensitive data, sudden disruption of business activities,
loss of customer and stakeholder trust, substantial reputational damage.
That's a big one. Huge financial losses, penalties arising
from the failure to comply with regulations.
This is not the first module we've
addressed all this, but revisiting the impact of cyber crime, that just more
heavily illustrates or emphasizes the need for forensics,
which forensics hold purposes to make sure it doesn't happen again.
Figure out exactly how it happened and then fix the issue and nail the
perpetrators to the wall so people think twice about trying it again.
You have a deterrent effect of punishment and you have a corrective aspect to all
this where you go back and you shore up the security, whatever was violated.