Forensic Readiness. Presented by: Jack J. Murphy, Ph.D.
|
|
|
- Kerry Golden
- 8 years ago
- Views:
Transcription
1 Forensic Readiness Presented by: Jack J. Murphy, Ph.D.
2 Corporate Capabilities Advanced Network Technologies IPV6, MPLS/VPLS, VoIP, DWDM Micromuse Netcool Certified Government Integrator Enterprise Security Network, Host, Application Security Solutions International Information System Security Certification Consortium (ISC)2 Resources (CISSP) Infrastructure Applications Network, Host, Application Monitoring & Management Desktop/Server Software Management/Provisioning 8/20/2007 2
3 Background Forensic Science The application of science to the law Digital Forensic The application of science to the identification, collection, analysis, and examination of digital evidence (DFI) while preserving the integrity of the information and maintaining a strict chain of custody for the evidence Types of Digital Forensic Investigation (DFI) Computer Network Others 8/20/2007 3
4 Background (Cont.) Forensic Readiness The ability of an organization to maximize its potential to use digital evidence while minimizing the cost of an investigation Anti-forensics The application of tools and techniques to conceal or destroy information so that others cannot access it. Benign uses: Donating used equipment to charity, removing data on public (kiosk) computers to preserve the users privacy, equipment disposal Nefarious uses: Confounding incident responders data analysis activities 8/20/2007 4
5 Context Criminal activity represents a small fraction of the need for a forensic analysis capability, e.g., Troubleshooting performance anomalies Virus Remediation/Clean-up IDS/Firewall/Operating System Alarm Response But, chain-of-custody formalisms, evidence collection/handling rules, and privacy concerns must be applied in coordination with legal and law enforcement organizations Specialized disciplines require specialized skills e.g., Forensic Accounting, Forensic Engineering, and Software Forensics 8/20/2007 5
6 Context (cont.) Incident Types 1 Threats and extortion Accidents and negligence Stalking and harassment Commercial disputes Disagreements, deceptions, and malpractice Property rights infringements Economic crime (fraud, money laundering) Content abuse Privacy Invasion and identity theft Employee disciplinary issues 1. A 10 Step Process for Forensic Readiness International Journal of Digital Evidence Winter 2004, Vol. 2, Issue 3 8/20/2007 6
7 Analysis Process 2 Performed in the context of an enterprise forensic policy Organization Tools and Procedures Roles and Responsibilities 2. NIST Special Publication August 2005 (draft) 8/20/2007 7
8 Acquisition File/Mail/Application Servers System Log Files Phone Log Files Backup/Archive Systems Firewall Audit/Log Records IDS, Antivirus, Spyware logs Hard Disk/Removable Media ISP Log Files Alternative Work Place Adjacent systems persons Interviews and Paper Documents Keystroke monitoring RAM and BIOS content 8/20/2007 8
9 Acquisition (Cont.) Collecting the Data Step 1 Develop a Plan Likely Value Consider data sources and incident circumstances Volatility Give high priority to volatile sources Effort Consider time & complexity,outside experts, legal advisors, law enforcement, special equipment Step 2 Collect the Data Use Certified Tools for Volatile Data Duplicate non-volatile data locally if possible Use write blockers if possible (e.g., on workstations) Step 3 Verify the Integrity of the Data (SHA-1 and/or MD-5) Source Copy Source Again 8/20/2007 9
10 Acquisition (Cont.) Heisenberg Uncertainty Principle: If you know where a particle is you can t measure with precision its speed (and vice versa) without altering it! Forensic analyst dilemma: Any attempt to capture data precisely will most likely alter it! Despite write-blockers! And vice versa!! 8/20/
11 Examination Requires sophisticated tools for Discovery Selection/Exclusion, Pattern Matching Correlation and comparison (e.g., to a baseline config.) Employs scientific methods to draw conclusions 8/20/
12 Examination (cont.) Challenges Recovery of Deleted Files Slack Space (unused space in the last block of a file or memory page) Free Space (unused partition,file system, or memory blocks) Missing/Renamed Files/Alternate Data-streams/File Metadata Exploited File/Protocol Formats (covert channels) Altered Operating System Files, Partition Table, File System, File Headers, File Names, File Extensions, File Modify/Access/Create Attribute Eliminating Safe Files using NSRL Reference Data Set ( 8/20/
13 Examination (cont.) Challenges (Cont.) Detecting Steganography Encryption Compression Volatile data Operating network configuration, open ports, running processes, open files, login sessions, operating system time Recovering password hashes before shutdown Rootkit discovery and response 8/20/
14 Anti-Forensics Known Hiding Techniques Media Management Layer Hide data in unused partitions, the boot sector, or in the partition table itself File System Layer Hide data in the file system data structure itself, file slack space, inode/data-stream, or socially-engineered file/directory names, removal of open files (volatile data), and other tricky stuff Application Layer Obfuscated/offset loopback filesystems, unused fields in application file formats Exploits of journaling file systems Very tricky 8/20/
15 Steganography gif-it-up ( color pallet) Jphs (lossy, e.g.,jpeg) S-Tools (lossless, e.g.,.wav) 8/20/
16 Cryptography Kerckhoff's Principle: The security of a cryptosystem shall not be based on keeping the algorithm secret but solely on keeping the key secret. In other words, assume your opponent knows the cryptosystem being used. Encrypted files look a lot like compressed files Need to determine file format ( Need to recover keys (if possible) from volatile storage/memory (e.g., swap file or memory dump) 8/20/
17 Utilization Requires Understanding of the purpose of the investigation Presentation skills and audience analysis Objectivity 8/20/
18 Data Utilization Factors Affecting Data Utilization Data Reduction Purpose is to present only the necessary & relevant facts, to the proper people only, to help them understand what occurred and what might need to be done Alternatives In the absence of conclusive data about what happened, fairly consider alternative explanations and present them Audience The CXO needs are different; so are the security, system administrator, and others responsible for daily operations Actionable For prevention, legal/administrative response, and follow-on investigation not forensic related 8/20/
19 Review Hot Wash Formal, Structured Review What went right, What went wrong Process/Procedure/Policy Review Training/Tool Improvements Team Peer Review Implement and Validate Changes 8/20/
20 Preparing for an Investigation Three Aspects: Prevention Detection Response A 30 minute attack required an average of 48 hours of forensic investigation by the best and brightest investigators 3 Only includes examination phase--no acquisition, utilization, or review Doesn t count outages, cleanup, etc. And none of 13 teams found everything! NETWORK VULNERABILITY ASSESSMENT APPLICATION ASSESSMENT HOST HARDENING FORENSIC READINESS POLICY WRITING INTRUSION DETECTION INCIDENT RESPONSE PLANNING INCIDENT FORENSIC ACQUISITION INCIDENT RESPONSE EXAMINATION UTILIZATION REVIEW PROSECUTION INTRUDER TRACKING /20/
21 Preparing for an Investigation (cont.) Prevention Implement policies that support cyber forensics Retaining Information Planning the Response Training Accelerating the Investigation Preventing Anonymous Activities Protecting the Evidence Policy Characteristics User Focused Monitoring Acceptable use Organizational Roles/Responsibilities Incident Response Guidelines Forensic Team Closely linked to Business Continuity Plan 8/20/
22 Preparing for an Investigation Detection Implement technologies that support cyber forensics NTP, backup, IDS, system logs, unique identification CCTV, RFID, honeypots Implement processes that support cyber forensics Train people on the processes and technologies 8/20/
23 Preparing for an Investigation Response Team Composition Forensics Team Subject/Suspect/Staff HR/PR Staff Process/Data Owners Management Claimant Corporate Security IT Staff Legal Follow the analysis process Operating procedures should address quarantine guidelines Follow evidence handling procedures (rules of evidence) Important note: Containment and recovery objectives compete with forensic objectives (the Heisenberg Principle) 8/20/
24 Preparing for an Investigation (cont.) Factors affecting the time and cost How logging is done What is logged IDS Forensic Acquisition Phase of Analysis Process Evidence Handling 8/20/
25 A 10 Step Approach to Forensics Readiness Define the business scenarios that require digital evidence Identify available sources/types of evidence Establish evidence collection requirements Establish a capability to securely gather legally admissible evidence Establish a policy for storage/handling of evidence Ensure monitoring is targeted to detect/deter major incidents Identify circumstances requiring escalation to full/formal investigation Train staff on incident awareness/roles/law Document incidents and impact base on evidence Ensure legal review to facilitate action in response to an incident 8/20/
26 Forensic Readiness Costs Updates to policy Improvements in training Systematic evidence gathering Secure storage of evidence Incident preparation Legal advice Developing an in-house DFI capability 8/20/
27 Forensic Readiness Benefits Enterprise defense Deterrent to insider threat Minimal disruption to the business in the event of an incident Reduced cost/time for internal investigation Extends information security to the wider threat from cyber crime Demonstrates due diligence and good enterprise governance Demonstrates compliance with regulatory requirements Improve the prospect for successful legal action Supports employee sanctions based on digital evidence 8/20/
28 Other Best Practices Establish a Tools Library consisting of NIST evaluated Forensic Tools AccessData Forensic Toolkit (FTK) ( Have a baseline image for each host type Consider certification Certified Cybercrime First Responder (CCFR) Certified Computer Forensics Technician (CCFT) Certified Forensic Computer Examiner (CFCE) Certified Information System Auditor (CISA) 8/20/
29 Tools Software-based Disk Imaging Tools Linux dd, EnCase, SafeBack, ILook Hardware-based Disk Imaging Tools SOLO Forensics, Solitaire Software-based Write-blockers PDBlock, Writeblocker XP Hardware-base Write-blockers FastBloc, SCSIBlock Forensic Boot CD Helix/Knoppix 8/20/
30 Resources NIST Special Publication Guide to Computer and Network Data Analysis-Applying Forensic Techniques to Incident Response (Aug draft) NIST Special Publication Computer Security Incident Handling Guide Computer Forensic Tool Testing ( National Software Reference Library (NSRL) Reference Data Set (RDS) ( The Ultimate Collection of Forensic Software ( File format specifications ( HoneyNet Project ( A Ten Step Process for Forensic Readiness, International Journal of Digital Evidence, Vol 2, Issue 3 8/20/
31 Services Data Recovery Data Recovery Services, DriveSavers, Ontrack Data Recovery Off-Site Backup SunGard 8/20/
32 Contact Info Internet: Phone: Mail: 4031 University Drive Suite 200 Fairfax, VA /20/
EC-Council Ethical Hacking and Countermeasures
EC-Council Ethical Hacking and Countermeasures Description This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1
MSc Computer Security and Forensics Cohort: MCSF/09B/PT Examinations for 2009-2010 / Semester 1 MODULE: COMPUTER FORENSICS & CYBERCRIME MODULE CODE: SECU5101 Duration: 2 Hours Instructions to Candidates:
ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING
ENTERPRISE COMPUTER INCIDENT RESPONSE AND FORENSICS TRAINING MODULE A INTRODUCTION TO COMPUTER FORENSICS AND NVESTIGATIONS A1.0 Explain concepts related to computer forensics. A1.1 This module is measured
Course Title: Computer Forensic Specialist: Data and Image Files
Course Title: Computer Forensic Specialist: Data and Image Files Page 1 of 9 Course Description The Computer Forensic Series by EC-Council provides the knowledge and skills to identify, track, and prosecute
Computer Hacking Forensic Investigator v8
CÔNG TY CỔ PHẦN TRƯỜNG CNTT TÂN ĐỨC TAN DUC INFORMATION TECHNOLOGY SCHOOL JSC LEARN MORE WITH LESS! Computer Hacking Forensic Investigator v8 Course Description: EC-Council releases the most advanced Computer
Incident Response. Six Best Practices for Managing Cyber Breaches. www.encase.com
Incident Response Six Best Practices for Managing Cyber Breaches www.encase.com What We ll Cover Your Challenges in Incident Response Six Best Practices for Managing a Cyber Breach In Depth: Best Practices
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065
Computer Forensics and Investigations Duration: 5 Days Courseware: CT 0619217065 Introduction The Computer Forensics and Investigation course presents methods to properly conduct a computer forensics investigation
How To Get A Computer Hacking Program
CHFI v8(computer Hacking Forensics Investigator) Course Description & Overview Overview CHFIv8 Course Description EC-Council releases the brand new Version 8 of the Computer Hacking Forensics Investigator
The Role of Digital Forensics within a Corporate Organization
May 2006, IBSA Conference, Vienna The Role of Digital Forensics within a Corporate Organization Bruce J. Nikkel IT Investigation & Forensics Risk Control, UBS AG Presentation Summary An overview of digital
Hands-On How-To Computer Forensics Training
j8fm6pmlnqq3ghdgoucsm/ach5zvkzett7guroaqtgzbz8+t+8d2w538ke3c7t 02jjdklhaMFCQHihQAECwMCAQIZAQAKCRDafWsAOnHzRmAeAJ9yABw8v2fGxaq skeu29sdxrpb25zidxpbmznogtheories...ofhilz9e1xthvqxbb0gknrc1ng OKLbRXF/j5jJQPxXaNUu/It1TQHSiyEumrHNsnn65aUMPnrbVOVJ8hV8NQvsUE
Information Technology Audit & Forensic Techniques. CMA Amit Kumar
Information Technology Audit & Forensic Techniques CMA Amit Kumar 1 Amit Kumar & Co. (Cost Accountants) A perfect blend of Tax, Audit & Advisory services Information Technology Audit & Forensic Techniques
Digital Forensics Tutorials Acquiring an Image with FTK Imager
Digital Forensics Tutorials Acquiring an Image with FTK Imager Explanation Section Digital Forensics Definition The use of scientifically derived and proven methods toward the preservation, collection,
Digital Forensic. A newsletter for IT Professionals. I. Background of Digital Forensic. Definition of Digital Forensic
I Digital Forensic A newsletter for IT Professionals Education Sector Updates Issue 10 I. Background of Digital Forensic Definition of Digital Forensic Digital forensic involves the collection and analysis
Introduction. IMF Conference September 2008
Live Forensic Acquisition as Alternative to Traditional Forensic Processes Marthie Lessing* Basie von Solms Introduction The Internet and technology developments introduced a sharp increase in computer
Certified Cyber Security Analyst VS-1160
VS-1160 Certified Cyber Security Analyst Certification Code VS-1160 Vskills certification for Cyber Security Analyst assesses the candidate as per the company s need for cyber security and forensics. The
Chapter 7 Securing Information Systems
1 Chapter 7 Securing Information Systems LEARNING TRACK 3: COMPUTER FORENSICS For thirty years, a serial murderer known as the BTK killer (standing for bind, torture, and kill) remained at large in Wichita,
information security and its Describe what drives the need for information security.
Computer Information Systems (Forensics Classes) Objectives for Course Challenges CIS 200 Intro to Info Security: Includes managerial and Describe information security and its critical role in business.
Scene of the Cybercrime Second Edition. Michael Cross
Scene of the Cybercrime Second Edition Michael Cross Chapter 1 Facing the Cybercrime Problem Head-On 1 Introduction 2 Defining Cybercrime 2 Understanding the Importance of Jurisdictional Issues 3 Quantifying
2! Bit-stream copy. Acquisition and Tools. Planning Your Investigation. Understanding Bit-Stream Copies. Bit-stream Copies (contd.
Acquisition and Tools COMP 2555: Principles of Computer Forensics Autumn 2014 http://www.cs.du.edu/2555 1 Planning Your Investigation! A basic investigation plan should include the following activities:!
C HFI C HFI. EC-Council. EC-Council. Computer Hacking Forensic Investigator. Computer. Computer. Hacking Forensic INVESTIGATOR
1 TM C HFI Computer C HFI Computer Hacking Forensic INVESTIGATOR Hacking Forensic INVESTIGATOR TM v8 v8 2 Be the leader. Deserve a place in the CHFI certified elite class. Earn cutting edge skills in computer
GEARS Cyber-Security Services
Florida Department of Management Services Division of State Purchasing Table of Contents Introduction... 1 About GEARS... 2 1. Pre-Incident Services... 3 1.1 Incident Response Agreements... 3 1.2 Assessments
Incident Response and Forensics
Incident Response and Forensics Yiman Jiang, President and Principle Consultant Sumus Technology Ltd. James Crooks, Manager - Advisory Services PricewaterhouseCoopers LLP UBC 2007-04-12 Outline Computer
Ten Deadly Sins of Computer Forensics
Ten Deadly Sins of Computer Forensics Cyber criminals take advantage of the anonymity of the Internet to escape punishment. Computer Forensics has emerged as a new discipline to counter cyber crime. This
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student
C HFI C HFI. EC-Council. EC-Council. Computer Hacking Forensic Investigator. Computer. Computer. Hacking Forensic INVESTIGATOR
Page: 1 TM C HFI Computer C HFI Computer Hacking Forensic INVESTIGATOR Hacking Forensic INVESTIGATOR TM v8 v8 Page: 2 Be the leader. Deserve a place in the CHFI certified elite class. Earn cutting edge
Overview of Computer Forensics
Overview of Computer Forensics Don Mason, Associate Director National Center for Justice and the Rule of Law University of Mississippi School of Law [These materials are based on 4.3.1-4.3.3 in the National
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student
ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster
Security Standards Symantec shall maintain administrative, technical, and physical safeguards for the Symantec Network designed to (i) protect the security and integrity of the Symantec Network, and (ii)
e-discovery Forensics Incident Response
e-discovery Forensics Incident Response NetSecurity Corporation 21351 Gentry Drive Suite 230 Dulles, VA 20166 VA DCJS # 11-5605 Phone: 703.444.9009 Toll Free: 1.866.664.6986 Web: www.netsecurity.com Email:
Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation
Computer Forensics and Digital Investigation Computer Security EDA263, lecture 14 Ulf Larson Lecture outline! Introduction to Computer Forensics! Digital investigation! Conducting a Digital Crime Scene
(Instructor-led; 3 Days)
Information Security Manager: Architecture, Planning, and Governance (Instructor-led; 3 Days) Module I. Information Security Governance A. Introduction to Information Security Governance B. Overview of
Where is computer forensics used?
What is computer forensics? The preservation, recovery, analysis and reporting of digital artifacts including information stored on computers, storage media (such as a hard disk or CD-ROM), an electronic
Digital Forensics. Tom Pigg Executive Director Tennessee CSEC
Digital Forensics Tom Pigg Executive Director Tennessee CSEC Definitions Digital forensics Involves obtaining and analyzing digital information as evidence in civil, criminal, or administrative cases Analyze
Contents. vii. Preface. P ART I THE HONEYNET 1 Chapter 1 The Beginning 3. Chapter 2 Honeypots 17. xix
Honeynet2_bookTOC.fm Page vii Monday, May 3, 2004 12:00 PM Contents Preface Foreword xix xxvii P ART I THE HONEYNET 1 Chapter 1 The Beginning 3 The Honeynet Project 3 The Information Security Environment
Incident Response and Computer Forensics
Incident Response and Computer Forensics James L. Antonakos WhiteHat Forensics Incident Response Topics Why does an organization need a CSIRT? Who s on the team? Initial Steps Detailed Project Plan Incident
Certified Digital Forensics Examiner
Cyber Security Training & Consulting Certified Digital COURSE OVERVIEW 5 Days 40 CPE Credits $3,000 Digital is the investigation and recovery of data contained in digital devices. This data is often the
Global Cyber Range (GCR) Empowering the Cybersecurity Professional (CyPro)
Global Cyber Range (GCR) Empowering the Cybersecurity Professional (CyPro) NICE Conference 2014 CYBERSECURITY RESILIENCE A THREE TIERED SOLUTION NIST Framework for Improving Critical Infrastructure Cybersecurity
INCIDENT RESPONSE & COMPUTER FORENSICS, SECOND EDITION
" - * INCIDENT RESPONSE & COMPUTER FORENSICS, SECOND EDITION CHRIS PROSISE KEVIN MANDIA McGraw-Hill /Osborne New York Chicago San Francisco Lisbon London Madrid Mexico City Milan New Delhi San Juan Seoul
The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices
The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices Introduction As organizations rely more heavily on technology-based methods of communication, many corporations
Session 334 Incident Management. Jeff Roth, CISA, CGEIT, CISSP
Session 334 Incident Management Jeff Roth, CISA, CGEIT, CISSP SPEAKER BIOGRAPHY Jeff Roth, CISA, CGEIT Jeff Roth has over 25 years experience in IT audit, security, risk management and IT Governance experience
Digital Forensics: The aftermath of hacking attacks. AHK Committee Meeting April 19 th, 2015 Eng. Jamal Abdulhaq Logos Networking FZ LLC
Digital Forensics: The aftermath of hacking attacks AHK Committee Meeting April 19 th, 2015 Eng. Jamal Abdulhaq Logos Networking FZ LLC Topics Digital Forensics: Brief introduction Case Studies Case I:
AN INTRODUCTION TO FORENSIC READINESS PLANNING TECHNICAL NOTE 01/2005
AN INTRODUCTION TO FORENSIC READINESS PLANNING TECHNICAL NOTE 01/2005 27 MAY 2005 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) a predecessor
CERTIFIED DIGITAL FORENSICS EXAMINER
CERTIFIED DIGITAL FORENSICS EXAMINER KEY DATA Course Title: C)DFE Duration: 5 days CPE Credits: 40 Class Format Options: Instructor-led classroom Live Online Training Computer Based Training Who Should
10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft)
1- A (firewall) is a computer program that permits a user on the internal network to access the internet but severely restricts transmissions from the outside 2- A (system failure) is the prolonged malfunction
Computer Forensics Today
L A W, I N V E S T I G A T I O N S, A N D E T H I C S Computer Forensics Today Kelly J. (KJ) Kuchta When people hear the word forensics, it often generates a mental image of the movie series with Jack
The Contribution of Tool Testing to the Challenge of Responding to an IT Adversary
The Contribution of Tool Testing to the Challenge of Responding to an IT Adversary Jim Lyle National Institute of Standards and Technology 23 October 2006 10/18/2006 1 DISCLAIMER Certain trade names and
Standard: Information Security Incident Management
Standard: Information Security Incident Management Page 1 Executive Summary California State University Information Security Policy 8075.00 states security incidents involving loss, damage or misuse of
Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
NIST CYBERSECURITY FRAMEWORK COMPLIANCE WITH OBSERVEIT
NIST CYBERSECURITY FRAMEWORK COMPLIANCE WITH OBSERVEIT OVERVIEW The National Institute of Standards of Technology Framework for Improving Critical Infrastructure Cybersecurity (The NIST Framework) is a
Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 2 Systems Threats and Risks
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 2 Systems Threats and Risks Objectives Describe the different types of software-based attacks List types of hardware attacks Define
AN INVESTIGATION INTO COMPUTER FORENSIC TOOLS
AN INVESTIGATION INTO COMPUTER FORENSIC TOOLS K.K. Arthur 1 H.S. Venter 2 Information and Computer Security Architectures (ICSA) Research Group University of Pretoria Pretoria Department of Computer Science
CYBER FORENSICS. KRISHNA SASTRY PENDYALA Cyber Forensic Division Central Forensic Science Laboratory Hyderabad.
CYBER FORENSICS KRISHNA SASTRY PENDYALA Cyber Forensic Division Central Forensic Science Laboratory Hyderabad. 11 DIGITAL EVIDENCE? Cyber crimes Digital evidence Digital evidence is any information of
Created By: 2009 Windows Server Security Best Practices Committee. Revised By: 2014 Windows Server Security Best Practices Committee
Windows Server Security Best Practices Initial Document Created By: 2009 Windows Server Security Best Practices Committee Document Creation Date: August 21, 2009 Revision Revised By: 2014 Windows Server
An overview of IT Security Forensics
An overview of IT Security Forensics Manu Malek, Ph.D. Stevens Institute of Technology mmalek@ieee.org www.cs.stevens.edu/~mmalek April 2008 IEEE Calif. 1 Outline Growing Threats/Attacks Need for Security
Guide to Computer Forensics and Investigations, Second Edition
Guide to Computer Forensics and Investigations, Second Edition Chapter 9 Data Acquisition Objectives Determine the best acquisition method Plan data-recovery contingencies Use MS-DOS acquisition tools
Forensic Certifications
Forensic Certifications Mayuri Shakamuri CS 489-02 Digital Forensics October 31, 2006 New Mexico Tech Executive Summary Digital Forensics is rapidly growing and evolving to become a scientific practice
Cyber Security Response to Physical Security Breaches
Cyber Security Response to Physical Security Breaches INTRODUCTION Physical break-ins and other unauthorized entries into critical infrastructure locations, such as electrical power substations, have historically
Summary of Technical Information Security for Information Systems and Services Managed by NUIT (Newcastle University IT Service)
Introduction This document provides a summary of technical information security controls operated by Newcastle University s IT Service (NUIT). These information security controls apply to all NUIT managed
ITU Session Four: Device Imaging And Analysis. Mounir Kamal Q-CERT
ITU Session Four: Device Imaging And Analysis Mounir Kamal Q-CERT 2 Applying Forensic Science to Computer Systems Like a Detective, the archaeologist searches for clues in order to discover and reconstruct
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE. Vahidin Đaltur, Kemal Hajdarević,
DIGITAL FORENSIC INVESTIGATION, COLLECTION AND PRESERVATION OF DIGITAL EVIDENCE Vahidin Đaltur, Kemal Hajdarević, Internacional Burch University, Faculty of Information Technlogy 71000 Sarajevo, Bosnia
Guide to Computer and Network Data Analysis: Applying Forensic Techniques to Incident Response
Special Publication 800-86 (Draft) Guide to Computer and Network Data Analysis: Applying Forensic Techniques to Incident Response Recommendations of the National Institute of Standards and Technology Tim
COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL)
COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL) COURSE DESCRIPTION: Computer Forensics is focused on teaching
Build Your Own Security Lab
Build Your Own Security Lab A Field Guide for Network Testing Michael Gregg WILEY Wiley Publishing, Inc. Contents Acknowledgments Introduction XXI xxiii Chapter 1 Hardware and Gear Why Build a Lab? Hackers
Getting Physical with the Digital Investigation Process
Getting Physical with the Digital Investigation Process Brian Carrier Eugene H. Spafford Center for Education and Research in Information Assurance and Security CERIAS Purdue University Abstract In this
Information Security By Bhupendra Ratha, Lecturer School of Library & Information Science D.A.V.V., Indore E-mail:bhu261@gmail.com Outline of Information Security Introduction Impact of information Need
Certified Cyber Security Analyst VS-1160
VS-1160 Certified Cyber Security Analyst Certification Code VS-1160 Vskills certification for Cyber Security Analyst assesses the candidate as per the company s need for cyber security and forensics. The
Impact of Digital Forensics Training on Computer Incident Response Techniques
Impact of Digital Forensics Training on Computer Incident Response Techniques Valorie J. King, PhD Collegiate Associate Professor University of Maryland University College Presentation to AFCEA June 25,
Computer Forensics Basics, First Responder, Collection of Evidence
May 7, 2008 1 Computer Forensics Basics, First Responder, Collection of Evidence Omveer Singh Joint Director / Scientist D omveer@cert-in.org.in Indian Computer Emergency Response Team (CERT-In) Department
Fundamentals of Network Security - Theory and Practice-
Fundamentals of Network Security - Theory and Practice- Program: Day 1... 1 1. General Security Concepts... 1 2. Identifying Potential Risks... 1 Day 2... 2 3. Infrastructure and Connectivity... 2 4. Monitoring
CDFE Certified Digital Forensics Examiner (CFED Replacement)
Course: CDFE Certified Digital Forensics Examiner (CFED Replacement) Description: Price: $3,450.00 Category: Popular Courses Duration: 5 days Schedule: Request Dates Outline: COURSE OVERVIEW Computer Forensics
Modern Digital Forensics!!
ISA 785 Research in Digital Forensics Modern Digital Forensics!! ISA 785! Angelos Stavrou, George Mason University! Modern Digital Forensics What s New 2! New Intellectual property concerns! IP/Brand related
How To Secure An Extended Enterprise
Data Security Initiatives The Layered Approach Melissa Perisce Regional Director, Global Services, South Asia April 25, 2010 2009 Verizon. All Rights Reserved. PTEXXXXX XX/09 Intel Case Study Asia North
Case Study: Hiring a licensed Security Provider
Case Study: Hiring a licensed Security Provider Company Profile McCann Investigations is a full service private investigation firm providing complete case solutions by employing cutting-edge computer forensics
CERIAS Tech Report 2003-29 GETTING PHYSICAL WITH THE DIGITAL INVESTIGATION PROCESS. Brian Carrier & Eugene H. Spafford
CERIAS Tech Report 2003-29 GETTING PHYSICAL WITH THE DIGITAL INVESTIGATION PROCESS Brian Carrier & Eugene H. Spafford Center for Education and Research in Information Assurance and Security, Purdue University,
Information Security Basic Concepts
Information Security Basic Concepts 1 What is security in general Security is about protecting assets from damage or harm Focuses on all types of assets Example: your body, possessions, the environment,
What is Digital Forensics?
DEVELOPING AN UNDERGRADUATE COURSE IN DIGITAL FORENSICS Warren Harrison PSU Center for Information Assurance Portland State University Portland, Oregon 97207 warren@cs.pdx.edu What is Digital Forensics?
Digital Forensics for IaaS Cloud Computing
Digital Forensics for IaaS Cloud Computing June 26, 2012 The views expressed in this presentation are mine alone. Reference to any specific products, process, or service do not necessarily constitute or
Client Security Risk Assessment Questionnaire
Select the appropriate answer from the drop down in the column, and provide a brief description in the section. 1 Do you have a member of your organization with dedicated information security duties? 2
Panel Title: Data Breaches: Industry and Law Enforcement Perspectives on Best Practices
Panel Title: Data Breaches: Industry and Law Enforcement Perspectives on Best Practices Over the course of this one hour presentation, panelists will cover the following subject areas, providing answers
How a Company s IT Systems Can Be Breached Despite Strict Security Protocols
How a Company s IT Systems Can Be Breached Despite Strict Security Protocols Brian D. Huntley, CISSP, PMP, CBCP, CISA Senior Information Security Advisor Information Security Officer, IDT911 Overview Good
2. From a control perspective, the PRIMARY objective of classifying information assets is to:
MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected
Supplier Information Security Addendum for GE Restricted Data
Supplier Information Security Addendum for GE Restricted Data This Supplier Information Security Addendum lists the security controls that GE Suppliers are required to adopt when accessing, processing,
IT Security Management 100 Success Secrets
IT Security Management 100 Success Secrets 100 Most Asked Questions: The Missing IT Security Management Control, Plan, Implementation, Evaluation and Maintenance Guide Lance Batten IT Security Management
Design and Implementation of a Live-analysis Digital Forensic System
Design and Implementation of a Live-analysis Digital Forensic System Pei-Hua Yen Graduate Institute of Information and Computer Education, National Kaohsiung Normal University, Taiwan amber8520@gmail.com
PRINCIPLES AND PRACTICE OF INFORMATION SECURITY
PRINCIPLES AND PRACTICE OF INFORMATION SECURITY Protecting Computers from Hackers and Lawyers Linda Volonino, Ph.D. Canisius College Stephen R. Robinson Verity Partners, LLC with contributions by Charles
Certified Information Systems Auditor (CISA)
Certified Information Systems Auditor (CISA) Course Introduction Course Introduction Module 01 - The Process of Auditing Information Systems Lesson 1: Management of the Audit Function Organization of the
nwstor Storage Security Solution 1. Executive Summary 2. Need for Data Security 3. Solution: nwstor isav Storage Security Appliances 4.
CONTENTS 1. Executive Summary 2. Need for Data Security 3. Solution: nwstor isav Storage Security Appliances 4. Conclusion 1. EXECUTIVE SUMMARY The advantages of networked data storage technologies such
Guideline on Auditing and Log Management
CMSGu2012-05 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Auditing and Log Management National Computer Board Mauritius
C. Author(s): David Millar (ISC Information Security) and Lauren Steinfeld (Chief Privacy Officer)
I. Title A. Name: Information Systems Security Incident Response Policy B. Number: 20070103-secincidentresp C. Author(s): David Millar (ISC Information Security) and Lauren Steinfeld (Chief Privacy Officer)
CompTIA Security+ Certification Study Guide. (Exam SYO-301) Glen E. Clarke. Gravu Hill
CompTIA Security+ Certification Study Guide (Exam SYO-301) Glen E. Clarke McGraw-Hill is an independent entity from CompTIA,This publication and CD may be used in assisting students to prepare for the
FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
Computer Forensics Standards:
Computer Forensics Standards: National Software Reference Library Computer Forensics Tool Testing Computer Forensics Reference Data Sets PDA Forensics Research Barbara Guttman bguttman@nist.gov September
Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 13 Business Continuity
Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 13 Business Continuity Objectives Define environmental controls Describe the components of redundancy planning List disaster recovery
introducing COMPUTER ANTI FORENSIC TECHNIQUES
introducing COMPUTER ANTI FORENSIC TECHNIQUES COMPUTER FORENSIC DATA RECOVERY TECHNIQUES AND SOLUTIONS WORKSHOP Executive Summary Computer Forensics, a term that precisely identifies the discipline that
Loophole+ with Ethical Hacking and Penetration Testing
Loophole+ with Ethical Hacking and Penetration Testing Duration Lecture and Demonstration: 15 Hours Security Challenge: 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once said,
IT Networking and Security
elearning Course Outlines IT Networking and Security powered by Calibrate elearning Course Outline CompTIA A+ 801: Fundamentals of Computer Hardware/Software www.medallionlearning.com Fundamentals of Computer
Digital Forensics. Larry Daniel
Digital Forensics Larry Daniel Introduction A recent research report from The Yankee Group found that 67.6 percent of US households in 2002 contained at least one PC The investigators foresee three-quarters
How To Manage Security On A Networked Computer System
Unified Security Reduce the Cost of Compliance Introduction In an effort to achieve a consistent and reliable security program, many organizations have adopted the standard as a key compliance strategy
DATA BREACH COVERAGE
THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ THIS CAREFULLY. DATA BREACH COVERAGE SCHEDULE OF COVERAGE LIMITS Coverage Limits of Insurance Data Breach Coverage $50,000 Legal Expense Coverage $5,000