Ten Deadly Sins of Computer Forensics

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Ten Deadly Sins of Computer Forensics"

Transcription

1 Ten Deadly Sins of Computer Forensics Cyber criminals take advantage of the anonymity of the Internet to escape punishment. Computer Forensics has emerged as a new discipline to counter cyber crime. This paper focuses on the ten deadly sins of Computer Forensics. 1. Introduction: The last decade has seen tremendous growth of information and communication technology (ICT), Internet and e-commerce. The ease and convenience associated with electronic channels has led to the proliferation of social networking sites, e-banking, e-retailing and numerous other e-services. This newfound ease has also led to the popularity and acceptance of e-payments through payment gateways, which have helped to make the Internet a repository of personal, financial and business information. The ICT revolution has also coincided with the emergence of transnational corporations, and growth of off shoring. This new grow industry has created a whole stream of intra-business and inter-business communications, functions, and data storage which depend largely on the use of computers, networks and all forms of ICT. Consequently, organizations hold a wide variety of customer and business data in electronic form. The flipside of this revolution has been the simultaneous growth of cyber crime. Cyber criminals are always on the lookout to steal different types of information through phishing, spamming and a host of other techniques. This has given rise to threats like identity theft, money laundering, credit card fraud, and infringement of copyrights among many others. The anonymity of the Internet sometimes, makes it difficult to trace the cyber criminals. This has resulted in the development of a new science known as computer forensics. 1.1 Computer Forensics Protection of customer, financial and business data is one of the prime concerns of organizations. Loss of data has both financial and legal implications. Organizations are vulnerable to cyber threats from both external and internal agents. Computer forensics is a science, which deals with collection, evaluation and analysis of data and information from networks, computers and storage devices with the purpose of presenting evidence of crime in a court of law. The data in computers may be either persistent or volatile. Page 1

2 Persistent data is in the form of files, databases, graphics, s and spreadsheets on the hard disk. Volatile data could be found in memory and registries. Investigators use techniques like imaging to collect data and cryptographic hash verification to identify modification of documents. It s obvious for perpetrators of crime to delete traces or files used by them. Computer forensics makes it possible to trace user activity and recover deleted mails, passwords, files, databases along with existing files and documents. 2. Ten Deadly Sins of Computer Forensics i. Investigators with inadequate experience: Computer Forensics is a specialized profession Evidence gathered during the course of a computer forensic investigation ought to be admissible in a court of law. The fate of a litigation of cyber crime depends on the credible evidence. Any negative outcome of litigation may have huge repercussions for the business. For example, banks need to protect confidential customer data regarding different financial products. Compromised data may damage the reputation of a bank. In such cases, it becomes crucial to identify the culprit whether internal or external, with credible evidence as quickly as possible. To protect the integrity of the information available on the crime scene or the affected device, investigators usually create a digital image of the hard disk. However, an inexperienced investigator may inadvertently tamper with the evidence through direct contact with the affected device. Any alteration to the evidence may make it inadmissible in a court. It is reasons like this that it is important for an organization to engage only skilled and certified computer forensics professionals. While engaging a forensics expert, organizations may consider factors such as requisite qualifications, experience and clientele. The organization may need to conduct background checks and cross check certifications, and they may also need to look for deliverables in the form of value for money, recommendations and speed of investigations. ii. Limited Scope of Investigations: Forensic experts may limit the scope of computer forensics investigations by prejudging that evidence would be available in a particular set of computers. The reasons may include judgment bias, to limit cost and lack of adequate expertise. Such prejudgments may backfire as evidence from certain systems, files, servers, and applications would remain uncollected. This would result in delays and adversely impact the result of litigation. Limited scope may also alter the nature of crime from criminal to civil case. Page 2

3 iii. Improper Planning The preparation phase is of immense importance for computer forensics experts. Computer forensics investigation may also be time sensitive depending upon the contract and court hearing date. Improper planning may result in inadequate incident response leading to loss of volatile evidence, delay in investigation and may alter the nature of the case. For instance, loss or alteration of volatile evidence may convert a criminal case to civil case or vice versa. Delays may also escalate cost of the investigation. A planned approach would involve formulating objectives of the investigation, evolving incident response system and using standard techniques. Sometimes, the evidence collection phase may take longer due to a large amount of data in the hard disk. This may not leave enough time for the subsequent phases of documentation, analysis and interpretation. The processing of evidence may take the computer forensics experts a lot of time of. The preparation phase may be used to make appropriate division of time for each of the phases. It would also help in identifying the requisite tools for faster collection of evidence. iv. Alteration caused by First responder After an incident, the first responders are usually the information security professionals of the organization such as system and network administrators. Information security professionals must be aware of the proper incident response procedures after a breach of their company s computer systems. The procedures in which an incident response is facilitated can also have an adverse implication on the evidence found on the affected systems. Some of the usual responses of a novice first responder in the event of system failure may include running an anti-virus program, restarting, shutting down, copying files, or formatting the drive and installing new software. However, these responses may wipe out crucial evidence such as volatile data. Ideally, an organization may designate a first response team consisting of professionals aware of the forensic collection policies. A first response team should document all requisite details of the incident (scenario, date and time, profile of affected computer devices, personnel involved and impact of device on normal functions of business). The team should get requisite approvals to monitor the affected device. The team should also formulate a data collection strategy and document all their actions such as the timeline of the collection process, forensic tools used and output received. A proper first response would be to verify the extent of crime and isolate affected devices and users from the network. v. Delay in Evidence collection Application of computer forensic tools helps in generating usage log and recovering lost files. However, evidence available on the computers may be time bound. Delays in evidence collection may be caused by lack of awareness, cost considerations, possibility of out of court settlements, and non-availability of desired experts on time. Page 3

4 Continuous usage of the affected computer system after the event may also result in overwriting of data and evidence degradation. Delays and interruptions may obstruct the creation of chain of evidence necessary for better analysis. Before proceeding with the evidence collection process, the First Response team should obtain to all requisite consent and authorization letters from the organization. The next step involves selection of appropriate methods of data collection, which is determined by the case scenario. It is important to initiate evidence collection as soon as possible, as evidence needs to be admissible in a court of law. For example, computer forensics helps in recovering deleted s, which may have crucial evidence regarding the crime. Timely collection of this evidence may be crucial for the success of the litigation. Imaging is one of the methods of collection and has proven crucial in data collection as this process creates an exact image of the hard drive including all drives, free spaces, disk partition, existing and deleted files. vi. Use of Outdated/Unlicensed Software: Collection, preservation and analysis of data for presenting admissible evidence are the major objectives of a computer forensic investigation, which is why it is crucial that forensic experts use the latest, standard and licensed software in their operations. Use of outdated, unlicensed or pirated software may not only lead to delays, failure of purpose, damage to computers, but may also lead to copyright infringement disputes. The evidence collected through unlicensed software may not be admissible in the court of law. vii. Insecure Location The computer systems and network systems under investigation should be free from tampering or manipulation. The systems should even be secure from internal agents because if an internal agent facilitated the crime, they may try to tamper with the evidence by modifying, destroying or overwriting the evidence. Be aware that unintentional operation of computers by unaware users may also lead to destruction of evidence. If possible, such systems may be shifted to a secure location; all computers, parts of dismantled computers and cable wires should be labeled. viii. Inadequate documentation All collected and preserved evidence needs to be properly documented. The documentation may incorporate information regarding the damage to the systems, consent letters, correspondence, date and time of evidence collection, detailed description of collected evidence, details of recovered data-file names, file creation and modification dates, images, and photographs, techniques used to gather evidence, details of licensed software used for forensics investigation, findings, Page 4

5 analysis and interpretation. Since the final document may be presented in court, it needs to be crosschecked for errors and mistakes. Proper documentation can play a key role in the outcome of the litigation. ix. Lack of adequate knowledge of legal requirements The evidence collected and analyzed by the forensic experts can be presented in a court of law therefore the experts need to be aware of the legal requirements as they pertain to evidence management and documentation. In addition, the computer forensics report must be drafted in a manner that it is easily understandable to the attorneys. If the presentation is not convincing enough, the benefit of processing the evidence and analysis may never come to fruition. The forensic expert should also anticipate legal hurdles and counter arguments by defendants. x. Inadvertent Disclosure of Privileged or sensitive information There always remains a risk of inadvertent disclosure of privileged corporate information. At times, it may be necessary to present collected evidence in court. In such cases, the expert needs to show caution in handling privileged corporate information. A computer forensic expert may come cross private communication between employees of the organization during the course of his investigation. When this happens, the computer forensic expert must follow an ethical code of conduct and judge whether revealing such information is required to substantiate a crime. 3. Conclusion: Computer forensics is a major breakthrough in the crusade against cyber crime. Nevertheless, challenges exist. Further awareness among information security professionals in handling evidence may aid in better results from computer forensics. The laws related to Cyber forensics are heterogeneous across the world and are still in the evolving stage. Page 5

Panel Title: Data Breaches: Industry and Law Enforcement Perspectives on Best Practices

Panel Title: Data Breaches: Industry and Law Enforcement Perspectives on Best Practices Panel Title: Data Breaches: Industry and Law Enforcement Perspectives on Best Practices Over the course of this one hour presentation, panelists will cover the following subject areas, providing answers

More information

e-discovery Forensics Incident Response

e-discovery Forensics Incident Response e-discovery Forensics Incident Response NetSecurity Corporation 21351 Gentry Drive Suite 230 Dulles, VA 20166 VA DCJS # 11-5605 Phone: 703.444.9009 Toll Free: 1.866.664.6986 Web: www.netsecurity.com Email:

More information

Network & Information Security Policy

Network & Information Security Policy Policy Version: 2.1 Approved: 02/20/2015 Effective: 03/02/2015 Table of Contents I. Purpose................... 1 II. Scope.................... 1 III. Roles and Responsibilities............. 1 IV. Risk

More information

NEW JERSEY STATE POLICE EXAMPLES OF CRIMINAL INTENT

NEW JERSEY STATE POLICE EXAMPLES OF CRIMINAL INTENT Appendix A to 11-02-P1-NJOIT NJ OFFICE OF INFORMATION TECHNOLOGY P.O. Box 212 www.nj.gov/it/ps/ 300 Riverview Plaza Trenton, NJ 08625-0212 NEW JERSEY STATE POLICE EXAMPLES OF CRIMINAL INTENT The Intent

More information

Spoliation of Evidence. Prepared for:

Spoliation of Evidence. Prepared for: Spoliation of Evidence Prepared for: Spoliation Nationwide anti-spoliation trend Cases can be thrown out of court Insurers can be denied subrogation claims An insured who destroys evidence of a claim can

More information

Legal Framework to Combat Cyber Crimes in the Region: Qatar as a Model. Judge Dr. Ehab Elsonbaty Cyber Crime expert ehabelsonbaty@hotmail.

Legal Framework to Combat Cyber Crimes in the Region: Qatar as a Model. Judge Dr. Ehab Elsonbaty Cyber Crime expert ehabelsonbaty@hotmail. Legal Framework to Combat Cyber Crimes in the Region: Qatar as a Model Judge Dr. Ehab Elsonbaty Cyber Crime expert ehabelsonbaty@hotmail.com Why should we care about CYBER CRIME & CYBER SECURITY? Clarification

More information

Reduce Cost and Risk during Discovery E-DISCOVERY GLOSSARY

Reduce Cost and Risk during Discovery E-DISCOVERY GLOSSARY 2016 CLM Annual Conference April 6-8, 2016 Orlando, FL Reduce Cost and Risk during Discovery E-DISCOVERY GLOSSARY Understanding e-discovery definitions and concepts is critical to working with vendors,

More information

Computer Forensics Today

Computer Forensics Today L A W, I N V E S T I G A T I O N S, A N D E T H I C S Computer Forensics Today Kelly J. (KJ) Kuchta When people hear the word forensics, it often generates a mental image of the movie series with Jack

More information

ISO 27001 Controls and Objectives

ISO 27001 Controls and Objectives ISO 27001 s and Objectives A.5 Security policy A.5.1 Information security policy Objective: To provide management direction and support for information security in accordance with business requirements

More information

ISO27001 Controls and Objectives

ISO27001 Controls and Objectives Introduction This reference document for the University of Birmingham lists the control objectives, specific controls and background information, as given in Annex A to ISO/IEC 27001:2005. As such, the

More information

Protecting against cyber threats and security breaches

Protecting against cyber threats and security breaches Protecting against cyber threats and security breaches IBM APT Survival Kit Alberto Benavente Martínez abenaventem@es.ibm.com IBM Security Services Jun 11, 2015 (Madrid, Spain) 12015 IBM Corporation So

More information

EXAMINATION OUTLINE FOR PRIVATE INVESTIGATORS

EXAMINATION OUTLINE FOR PRIVATE INVESTIGATORS EXAMINATION OUTLINE FOR PRIVATE INVESTIGATORS 2014 I. Ethics (18%) This area assesses the candidate s ability to comply with ethical standards of private investigators regarding privacy rights, confidentiality,

More information

Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation

Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation Computer Forensics and Digital Investigation Computer Security EDA263, lecture 14 Ulf Larson Lecture outline! Introduction to Computer Forensics! Digital investigation! Conducting a Digital Crime Scene

More information

Ten Questions Your Board Should be asking about Cyber Security. Eric M. Wright, Shareholder

Ten Questions Your Board Should be asking about Cyber Security. Eric M. Wright, Shareholder Ten Questions Your Board Should be asking about Cyber Security Eric M. Wright, Shareholder Eric Wright, CPA, CITP Started my career with Schneider Downs in 1983. Responsible for all IT audit and system

More information

Journal of Digital Forensic Practice

Journal of Digital Forensic Practice Journal of Digital Forensic Practice Journal of Digital Forensic Practice, 2:57 61, 2008 Copyright Taylor & Francis Group, LLC ISSN: 1556-7281 print / 1556-7346 online DOI: 10.1080/15567280801958464 UDFP

More information

Breakfast Meeting: Securing your Secured Data Digital Forensics, Fraud and Forensic Advancements

Breakfast Meeting: Securing your Secured Data Digital Forensics, Fraud and Forensic Advancements Breakfast Meeting: Securing your Secured Data Digital Forensics, Fraud and Forensic Advancements 9 April 2013 Facilitator: Dr. Sheau-Dong Lang, Coordinator Master of Science in Digital Forensics University

More information

MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1

MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1 MSc Computer Security and Forensics Cohort: MCSF/09B/PT Examinations for 2009-2010 / Semester 1 MODULE: COMPUTER FORENSICS & CYBERCRIME MODULE CODE: SECU5101 Duration: 2 Hours Instructions to Candidates:

More information

10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft)

10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft) 1- A (firewall) is a computer program that permits a user on the internal network to access the internet but severely restricts transmissions from the outside 2- A (system failure) is the prolonged malfunction

More information

Acceptable Use of Information Technology Policy

Acceptable Use of Information Technology Policy Acceptable Use of Information Technology Policy Bergen Community College reserves the right to monitor its information technology resources and telecommunications network to protect the integrity of its

More information

DATA AND PAYMENT SECURITY PART 1

DATA AND PAYMENT SECURITY PART 1 STAR has teamed up with Prevention of Fraud in Travel (PROFiT) and the Fraud Intelligence Network (FIN) to offer our members the best advice about fraud prevention. We recognise the increasing threat of

More information

Computer Forensics. Computer Forensics: History, Tools and Outlooks. By John Burns IT-103-002. Research Paper

Computer Forensics. Computer Forensics: History, Tools and Outlooks. By John Burns IT-103-002. Research Paper 1 Computer Forensics: History, Tools and Outlooks By John Burns IT-103-002 Research Paper 02/25/2012 "By placing this statement on my webpage, I certify that I have read and understand the GMU Honor Code

More information

Information Security Services

Information Security Services Information Security Services Information Security In 2013, Symantec reported a 62% increase in data breaches over 2012. These data breaches had tremendous impacts on many companies, resulting in intellectual

More information

ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster

ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster Security Standards Symantec shall maintain administrative, technical, and physical safeguards for the Symantec Network designed to (i) protect the security and integrity of the Symantec Network, and (ii)

More information

Monitoring and Logging Policy. Document Status. Security Classification. Level 1 - PUBLIC. Version 1.0. Approval. Review By June 2012

Monitoring and Logging Policy. Document Status. Security Classification. Level 1 - PUBLIC. Version 1.0. Approval. Review By June 2012 Monitoring and Logging Policy Document Status Security Classification Version 1.0 Level 1 - PUBLIC Status DRAFT Approval Life 3 Years Review By June 2012 Owner Secure Research Database Analyst Change History

More information

Computing and Network Use Policy

Computing and Network Use Policy Computing and Network Use Policy Category: University Area Date Established: Responsible Office: Office of the Chief Information Officer Date Last Revised: - 3/26/2007 Responsible Executive: CIO Date Posted

More information

Digital Forensic. A newsletter for IT Professionals. I. Background of Digital Forensic. Definition of Digital Forensic

Digital Forensic. A newsletter for IT Professionals. I. Background of Digital Forensic. Definition of Digital Forensic I Digital Forensic A newsletter for IT Professionals Education Sector Updates Issue 10 I. Background of Digital Forensic Definition of Digital Forensic Digital forensic involves the collection and analysis

More information

STATE OF WYOMING Electronic Mail Policy

STATE OF WYOMING Electronic Mail Policy Introduction: STATE OF WYOMING Electronic Mail Policy Pursuant to Executive Order 1999-4 dated the 23rd of December, 1999 Electronic mail (e-mail) enables the user to send and receive messages, make appointments,

More information

Introduction to Data Forensics. Jeff Flaig, Security Consultant January 15, 2014

Introduction to Data Forensics. Jeff Flaig, Security Consultant January 15, 2014 Introduction to Data Forensics Jeff Flaig, Security Consultant January 15, 2014 WHAT IS COMPUTER FORENSICS Computer forensics is the process of methodically examining computer media (hard disks, diskettes,

More information

FRAMEWORK. Continuous Process Improvement Risk, Information Security, and Compliance

FRAMEWORK. Continuous Process Improvement Risk, Information Security, and Compliance FRMEWORK Continuous Process Improvement Risk, Information Security, and Compliance The pragmatic, business-oriented, standardsbased methodology for managing information. CPI-RISC Information Risk Framework

More information

GUIDELINES FOR ELECTRONIC BANKING

GUIDELINES FOR ELECTRONIC BANKING SUPERVISORY AND REGULATORY GUIDELINES: PU23-0506 6 th June, 2006 GUIDELINES FOR ELECTRONIC BANKING I. INTRODUCTION The Central Bank of The Bahamas ( the Central Bank ) is responsible for the licensing,

More information

C HFI C HFI. EC-Council. EC-Council. Computer Hacking Forensic Investigator. Computer. Computer. Hacking Forensic INVESTIGATOR

C HFI C HFI. EC-Council. EC-Council. Computer Hacking Forensic Investigator. Computer. Computer. Hacking Forensic INVESTIGATOR Page: 1 TM C HFI Computer C HFI Computer Hacking Forensic INVESTIGATOR Hacking Forensic INVESTIGATOR TM v8 v8 Page: 2 Be the leader. Deserve a place in the CHFI certified elite class. Earn cutting edge

More information

ESI Risk Assessment: Critical in Light of the new E-discovery and notification laws

ESI Risk Assessment: Critical in Light of the new E-discovery and notification laws ESI Risk Assessment: Critical in Light of the new E-discovery and notification laws Scott Bailey, CISM Christopher Sobota, J.D. Enterprise Risk Management Group Disclaimer This presentation is for informational

More information

Computer Forensics Preparation

Computer Forensics Preparation Computer Forensics Preparation This lesson covers Chapters 1 and 2 in Computer Forensics JumpStart, Second Edition. OBJECTIVES When you complete this lesson, you ll be able to Discuss computer forensics

More information

The FBI Cyber Program. Bauer Advising Symposium //UNCLASSIFIED

The FBI Cyber Program. Bauer Advising Symposium //UNCLASSIFIED The FBI Cyber Program Bauer Advising Symposium October 11, 2012 Today s Agenda What is the threat? Who are the adversaries? How are they attacking you? What can the FBI do to help? What can you do to stop

More information

Symantec Cyber Threat Analysis Program Program Overview. Symantec Cyber Threat Analysis Program Team

Symantec Cyber Threat Analysis Program Program Overview. Symantec Cyber Threat Analysis Program Team Symantec Cyber Threat Analysis Program Symantec Cyber Threat Analysis Program Team White Paper: Symantec Security Intelligence Services Symantec Cyber Threat Analysis Program Contents Overview...............................................................................................

More information

Cyber Threats: Exposures and Breach Costs

Cyber Threats: Exposures and Breach Costs Issue No. 2 THREAT LANDSCAPE Technological developments do not only enhance capabilities for legitimate business they are also tools that may be utilized by those with malicious intent. Cyber-criminals

More information

Feature. How to Maximize Evidential Weight of Electronically Stored Information Recommendations of BS 10008

Feature. How to Maximize Evidential Weight of Electronically Stored Information Recommendations of BS 10008 Feature Haris Hamidovic, CIA, ISMS IA, ITIL, IT Project+, is chief information security officer at Microcredit Foundation EKI Sarajevo, Bosnia and Herzegovina. Prior to his current assignment, Hamidovic

More information

THE NEW REALITY OF RISK CYBER RISK: TRENDS AND SOLUTIONS

THE NEW REALITY OF RISK CYBER RISK: TRENDS AND SOLUTIONS THE NEW REALITY OF RISK CYBER RISK: TRENDS AND SOLUTIONS Read the Marsh Risk Management Research Briefing: Cyber Risks Extend Beyond Data and Privacy Exposures To access the report, visit www.marsh.com.

More information

California State University, Sacramento INFORMATION SECURITY PROGRAM

California State University, Sacramento INFORMATION SECURITY PROGRAM California State University, Sacramento INFORMATION SECURITY PROGRAM 1 I. Preamble... 3 II. Scope... 3 III. Definitions... 4 IV. Roles and Responsibilities... 5 A. Vice President for Academic Affairs...

More information

Addendum Windows Azure Data Processing Agreement Amendment ID M129

<Choose> Addendum Windows Azure Data Processing Agreement Amendment ID M129 Addendum Amendment ID Proposal ID Enrollment number Microsoft to complete This addendum ( Windows Azure Addendum ) is entered into between the parties identified on the signature form for the

More information

Overview of Computer Forensics

Overview of Computer Forensics Overview of Computer Forensics Don Mason, Associate Director National Center for Justice and the Rule of Law University of Mississippi School of Law [These materials are based on 4.3.1-4.3.3 in the National

More information

Belmont Savings Bank. Are there Hackers at the gate? 2013 Wolf & Company, P.C.

Belmont Savings Bank. Are there Hackers at the gate? 2013 Wolf & Company, P.C. Belmont Savings Bank Are there Hackers at the gate? 2013 Wolf & Company, P.C. MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2013 Wolf & Company, P.C. About Wolf & Company, P.C.

More information

Information Security Incident Management Guidelines

Information Security Incident Management Guidelines Information Security Incident Management Guidelines INFORMATION TECHNOLOGY SECURITY SERVICES http://safecomputing.umich.edu Version #1.0, June 21, 2006 Copyright 2006 by The Regents of The University of

More information

The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices

The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices Introduction As organizations rely more heavily on technology-based methods of communication, many corporations

More information

Logging the Pillar of Compliance

Logging the Pillar of Compliance WHITEPAPER Logging the Pillar of Compliance Copyright 2000-2011 BalaBit IT Security All rights reserved. www.balabit.com 1 Table of Content Introduction 3 Open-eyed management 4 ISO 27001 5 PCI DSS 5 Sarbanes

More information

Information Technology Audit & Forensic Techniques. CMA Amit Kumar

Information Technology Audit & Forensic Techniques. CMA Amit Kumar Information Technology Audit & Forensic Techniques CMA Amit Kumar 1 Amit Kumar & Co. (Cost Accountants) A perfect blend of Tax, Audit & Advisory services Information Technology Audit & Forensic Techniques

More information

Standard: Information Security Incident Management

Standard: Information Security Incident Management Standard: Information Security Incident Management Page 1 Executive Summary California State University Information Security Policy 8075.00 states security incidents involving loss, damage or misuse of

More information

Computer Forensics as an Integral Component of the Information Security Enterprise

Computer Forensics as an Integral Component of the Information Security Enterprise Computer Forensics as an Integral Component of the Information Security Enterprise By John Patzakis 10/28/03 I. EXECUTIVE SUMMARY In addition to fending off network intrusions and denial of service attacks,

More information

Identity Theft Prevention Program Red Flag Rules Policy P093.00 Issued: May 2009

Identity Theft Prevention Program Red Flag Rules Policy P093.00 Issued: May 2009 Identity Theft Prevention Program Red Flag Rules Policy P093.00 Issued: May 2009 The Federal Trade Commission has issued a final rule (the Red Flag Rule) under the Fair and Accurate Credit Transactions

More information

STATE OF HAWAI I INFORMATION PRIVACY AND SECURITY COUNCIL

STATE OF HAWAI I INFORMATION PRIVACY AND SECURITY COUNCIL STATE OF HAWAI I INFORMATION PRIVACY AND SECURITY COUNCIL Category Security, Breach Title Breach Best Practices Document: IPSC2009-02 Revision: 2009.08.28-01 Posted URL: http://ipsc.hawaii.gov Status Under

More information

COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL)

COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL) COMPUTER FORENSICS (EFFECTIVE 2013-14) ACTIVITY/COURSE CODE: 5374 (COURSE WILL BE LISTED IN THE 2013-14 CATE STUDENT REPORTING PROCEDURES MANUAL) COURSE DESCRIPTION: Computer Forensics is focused on teaching

More information

Contact: Henry Torres, (870) 972-3033

Contact: Henry Torres, (870) 972-3033 Information & Technology Services Management & Security Principles & Procedures Executive Summary Contact: Henry Torres, (870) 972-3033 Background: The Security Task Force began a review of all procedures

More information

Terms of Service. This online privacy policy applies only to information collected through our website and not to information collected offline.

Terms of Service. This online privacy policy applies only to information collected through our website and not to information collected offline. Terms of Service Privacy Policy Mahavitaran (mahadiscom) respects and protects the privacy of the individuals that access the information and use the services brought through them. Individually identifiable

More information

Computer Forensics US-CERT

Computer Forensics US-CERT Computer Forensics US-CERT Overview This paper will discuss the need for computer forensics to be practiced in an effective and legal way, outline basic technical issues, and point to references for further

More information

RUTGERS POLICY. Section Title: Legacy UMDNJ policies associated with Information Technology

RUTGERS POLICY. Section Title: Legacy UMDNJ policies associated with Information Technology RUTGERS POLICY Section: 70.2.20 Section Title: Legacy UMDNJ policies associated with Information Technology Policy Name: Information Security: Incident Management Formerly Book: 95-01-09-02:00 Approval

More information

Digital Evidence Search Kit

Digital Evidence Search Kit Digital Evidence Search Kit K.P. Chow, C.F. Chong, K.Y. Lai, L.C.K. Hui, K. H. Pun, W.W. Tsang, H.W. Chan Center for Information Security and Cryptography Department of Computer Science The University

More information

Compliance White Paper September 1, 2005 Steven Richardson Compliance and Computer Forensics

Compliance White Paper September 1, 2005 Steven Richardson  Compliance and Computer Forensics Compliance White Paper September 1, 2005 Steven Richardson srichardson@techpathways.com www.techpathways.com Compliance and Computer Forensics Information security compliance requires the precise enforcement

More information

Miami University. Payment Card Data Security Policy

Miami University. Payment Card Data Security Policy Miami University Payment Card Data Security Policy IT Policy IT Standard IT Guideline IT Procedure IT Informative Issued by: IT Services SCOPE: This policy covers all units within Miami University that

More information

U.S. Department of the Interior's Federal Information Systems Security Awareness Online Course

U.S. Department of the Interior's Federal Information Systems Security Awareness Online Course U.S. Department of the Interior's Federal Information Systems Security Awareness Online Course Rules of Behavior Before you print your certificate of completion, please read the following Rules of Behavior

More information

C. Author(s): David Millar (ISC Information Security) and Lauren Steinfeld (Chief Privacy Officer)

C. Author(s): David Millar (ISC Information Security) and Lauren Steinfeld (Chief Privacy Officer) I. Title A. Name: Information Systems Security Incident Response Policy B. Number: 20070103-secincidentresp C. Author(s): David Millar (ISC Information Security) and Lauren Steinfeld (Chief Privacy Officer)

More information

Introduction. The steps involved in using this tool

Introduction. The steps involved in using this tool Introduction This tool is designed to cover all the relevant control areas of ISO / IEC 27001:2013. All sorts of organisations and Because it is a general tool, you may find the language challenging at

More information

Brainloop Cloud Security

Brainloop Cloud Security Whitepaper Brainloop Cloud Security Guide to secure collaboration in the cloud www.brainloop.com Sharing information over the internet The internet is the ideal platform for sharing data globally and communicating

More information

INFORMATION SECURITY POLICY DOCUMENT. The contents of this document are classified as DC 1 Private information

INFORMATION SECURITY POLICY DOCUMENT. The contents of this document are classified as DC 1 Private information 6 th Floor, Tower A, 1 CyberCity, Ebene, Mauritius T + 230 403 6000 F + 230 403 6060 E ReachUs@abaxservices.com INFORMATION SECURITY POLICY DOCUMENT Information Security Policy Document Page 2 of 15 Introduction

More information

RLI PROFESSIONAL SERVICES GROUP PROFESSIONAL LEARNING EVENT PSGLE 123. Cybersecurity: A Growing Concern for Small Businesses

RLI PROFESSIONAL SERVICES GROUP PROFESSIONAL LEARNING EVENT PSGLE 123. Cybersecurity: A Growing Concern for Small Businesses RLI PROFESSIONAL SERVICES GROUP PROFESSIONAL LEARNING EVENT PSGLE 123 Cybersecurity: A Growing Concern for Small Businesses Copyright Materials This presentation is protected by US and International Copyright

More information

National Cyber Security Month 2015: Daily Security Awareness Tips

National Cyber Security Month 2015: Daily Security Awareness Tips National Cyber Security Month 2015: Daily Security Awareness Tips October 1 New Threats Are Constantly Being Developed. Protect Your Home Computer and Personal Devices by Automatically Installing OS Updates.

More information

INFORMATION SECURITY MANAGEMENT SYSTEM. Version 1c

INFORMATION SECURITY MANAGEMENT SYSTEM. Version 1c INFORMATION SECURITY MANAGEMENT SYSTEM Version 1c Revised April 2011 CONTENTS Introduction... 5 1 Security Policy... 7 1.1 Information Security Policy... 7 1.2 Scope 2 Security Organisation... 8 2.1 Information

More information

DOCSVAULT WhitePaper. Concise Guide to E-discovery. Contents

DOCSVAULT WhitePaper. Concise Guide to E-discovery. Contents WhitePaper Concise Guide to E-discovery Contents i. Overview ii. Importance of e-discovery iii. How to prepare for e-discovery? iv. Key processes & issues v. The next step vi. Conclusion Overview E-discovery

More information

Case Study: Hiring a licensed Security Provider

Case Study: Hiring a licensed Security Provider Case Study: Hiring a licensed Security Provider Company Profile McCann Investigations is a full service private investigation firm providing complete case solutions by employing cutting-edge computer forensics

More information

Boston Public Schools. Guidelines for Implementation of Acceptable Use Policy for Digital Information, Communication, and. Technology Resources

Boston Public Schools. Guidelines for Implementation of Acceptable Use Policy for Digital Information, Communication, and. Technology Resources Boston Public Schools Guidelines for Implementation of Acceptable Use Policy for Digital Information, Communication, and Scope of Policy Technology Resources ACCEPTABLE USE POLICY AND GUIDELINES Boston

More information

Information Incident Management Policy

Information Incident Management Policy Information Incident Management Policy Change History Version Date Description 0.1 04/01/2013 Draft 0.2 26/02/2013 Replaced procedure details with broad principles 0.3 27/03/2013 Revised following audit

More information

Accounting and Administrative Manual Section 100: Accounting and Finance

Accounting and Administrative Manual Section 100: Accounting and Finance No.: C-13 Page: 1 of 6 POLICY: It is the policy of the University of Alaska that all payment card transactions are to be executed in compliance with standards established by the Payment Card Industry Security

More information

Federal Bureau of Investigation s Integrity and Compliance Program

Federal Bureau of Investigation s Integrity and Compliance Program Evaluation and Inspection Division Federal Bureau of Investigation s Integrity and Compliance Program November 2011 I-2012-001 EXECUTIVE DIGEST In June 2007, the Federal Bureau of Investigation (FBI) established

More information

Hamilton College Administrative Information Systems Security Policy and Procedures. Approved by the IT Committee (December 2004)

Hamilton College Administrative Information Systems Security Policy and Procedures. Approved by the IT Committee (December 2004) Hamilton College Administrative Information Systems Security Policy and Procedures Approved by the IT Committee (December 2004) Table of Contents Summary... 3 Overview... 4 Definition of Administrative

More information

WEST LOTHIAN COUNCIL INFORMATION SECURITY POLICY

WEST LOTHIAN COUNCIL INFORMATION SECURITY POLICY WEST LOTHIAN COUNCIL INFORMATION SECURITY POLICY DATA LABEL: PUBLIC INFORMATION SECURITY POLICY CONTENTS 1. INTRODUCTION... 3 2. MAIN OBJECTIVES... 3 3. LEGISLATION... 4 4. SCOPE... 4 5. STANDARDS... 4

More information

The Enhanced Digital Investigation Process Model

The Enhanced Digital Investigation Process Model The Enhanced Digital Investigation Process Model Venansius Baryamureeba and Florence Tushabe barya@ics.mak.ac.ug, tushabe@ics.mak.ac.ug Institute of Computer Science, Makerere University P.O.Box 7062,

More information

City of Boston Department of Innovation and Technology Policy Title: Information Technology Resource Use Policy Effective Date: April 1, 2011

City of Boston Department of Innovation and Technology Policy Title: Information Technology Resource Use Policy Effective Date: April 1, 2011 City of Boston Department of Innovation and Technology Policy Title: Information Technology Resource Use Policy Effective Date: April 1, 2011 Purpose and Intent The City of Boston recognizes the importance

More information

Is your business at risk? DO YOU NEED TO KNOW?

Is your business at risk? DO YOU NEED TO KNOW? Is your business at risk? DO YOU NEED TO KNOW? Do you need Penetration Testing? The main issues our clients have faced in the operational running of the business Client-side attacks Another growing security

More information

Regulation on Credit Reporting Industry

Regulation on Credit Reporting Industry Translated from Chinese Order of the State Council (No. 631) The Regulation on the Credit Reporting Industry, as adopted at the 228th session of the executive meeting of the State Council on December 26,

More information

UNIVERSITY OF ST ANDREWS. EMAIL POLICY November 2005

UNIVERSITY OF ST ANDREWS. EMAIL POLICY November 2005 UNIVERSITY OF ST ANDREWS EMAIL POLICY November 2005 I Introduction 1. Email is an important method of communication for University business, and carries the same weight as paper-based communications. The

More information

Digital Forensics & e-discovery Services

Digital Forensics & e-discovery Services Digital Forensics & e-discovery Services U.S. Security Associates Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities

More information

Protecting your business interests through intelligent IT security services, consultancy and training

Protecting your business interests through intelligent IT security services, consultancy and training Protecting your business interests through intelligent IT security services, consultancy and training The openness and connectivity of the digital economy today provides huge opportunities but also creates

More information

Guideline on Auditing and Log Management

Guideline on Auditing and Log Management CMSGu2012-05 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Auditing and Log Management National Computer Board Mauritius

More information

OVERVIEW. In all, this report makes recommendations in 14 areas, such as. Page iii

OVERVIEW. In all, this report makes recommendations in 14 areas, such as. Page iii The Office of the Auditor General has conducted a procedural review of the State Data Center (Data Center), a part of the Arizona Strategic Enterprise Technology (ASET) Division within the Arizona Department

More information

SAMPLE TEMPLATE. Massachusetts Written Information Security Plan

SAMPLE TEMPLATE. Massachusetts Written Information Security Plan SAMPLE TEMPLATE Massachusetts Written Information Security Plan Developed by: Jamy B. Madeja, Esq. Erik Rexford 617-227-8410 jmadeja@buchananassociates.com Each business is required by Massachusetts law

More information

Fostering Incident Response and Digital Forensics Research

Fostering Incident Response and Digital Forensics Research Fostering Incident Response and Digital Forensics Research Bruce J. Nikkel bruce.nikkel@ubs.com September 8, 2014 Abstract This article highlights different incident response topics with a focus on digital

More information

INFORMATION TECHNOLOGY SECURITY STANDARDS

INFORMATION TECHNOLOGY SECURITY STANDARDS INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL

More information

External Supplier Control Requirements

External Supplier Control Requirements External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must

More information

Sierra College ADMINISTRATIVE PROCEDURE No. AP 3721

Sierra College ADMINISTRATIVE PROCEDURE No. AP 3721 Sierra College ADMINISTRATIVE PROCEDURE No. AP 3721 Electronic Information Security and Data Backup Procedures Date Adopted: 4/13/2012 Date Revised: Date Reviewed: References: Health Insurance Portability

More information

Cyber- Attacks: The New Frontier for Fraudsters. Daniel Wanjohi, Technology Security Specialist

Cyber- Attacks: The New Frontier for Fraudsters. Daniel Wanjohi, Technology Security Specialist Cyber- Attacks: The New Frontier for Fraudsters Daniel Wanjohi, Technology Security Specialist What is it All about The Cyber Security Agenda ; Protecting computers, networks, programs and data from unintended

More information

Incident Response Plan for PCI-DSS Compliance

Incident Response Plan for PCI-DSS Compliance Incident Response Plan for PCI-DSS Compliance City of Monroe, Georgia Information Technology Division Finance Department I. Policy The City of Monroe Information Technology Administrator is responsible

More information

Introduction to Network Security Comptia Security+ Exam. Computer Forensics. Evidence. Domain 5 Computer Forensics

Introduction to Network Security Comptia Security+ Exam. Computer Forensics. Evidence. Domain 5 Computer Forensics Introduction to Network Security Comptia Security+ Exam Domain 5 Computer Forensics Computer Forensics Forensics relates to the application of scientific knowledge and method to legal problems Investigating

More information

Digital Forensics & e-discovery Services

Digital Forensics & e-discovery Services Digital Forensics & e-discovery Services Andrews International Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities

More information

Best Practices in Electronic Record Retention

Best Practices in Electronic Record Retention I. Some Key Considerations In Whether To Engage An E-Discovery Vendor (Or Vendors) A. It is difficult to decide whether to retain a vendor if you don t know what your organization can do and at what cost.

More information

A Guide to the Cyber Essentials Scheme

A Guide to the Cyber Essentials Scheme A Guide to the Cyber Essentials Scheme Published by: CREST Tel: 0845 686-5542 Email: admin@crest-approved.org Web: http://www.crest-approved.org/ Principal Author Jane Frankland, Managing Director, Jane

More information

Cyber Security Response to Physical Security Breaches

Cyber Security Response to Physical Security Breaches Cyber Security Response to Physical Security Breaches INTRODUCTION Physical break-ins and other unauthorized entries into critical infrastructure locations, such as electrical power substations, have historically

More information

COMPUTER FORENSICS IN THE BUSINESS ENVIRONMENT

COMPUTER FORENSICS IN THE BUSINESS ENVIRONMENT COMPUTER FORENSICS IN THE BUSINESS ENVIRONMENT Neven Bratranek, Boris Bereček Teched Consulting Services Radnička cesta 80/VII, 10000 Zagreb, Croatia {nevenb, borisb}@teched.hr Robert Kopal Visoka poslovna

More information

Corporate Incident Response. Why You Can t Afford to Ignore It

Corporate Incident Response. Why You Can t Afford to Ignore It Corporate Incident Response Why You Can t Afford to Ignore It Whether your company needs to comply with new legislation, defend against financial loss, protect its corporate reputation or a combination

More information

UF IT Risk Assessment Standard

UF IT Risk Assessment Standard UF IT Risk Assessment Standard Authority This standard was enacted by the UF Senior Vice President for Administration and the UF Interim Chief Information Officer on July 10, 2008 [7]. It was approved

More information

Administrative Procedures Memorandum A1452

Administrative Procedures Memorandum A1452 Page 1 of 11 Date of Issue February 2, 2010 Original Date of Issue Subject References February 2, 2010 PRIVACY BREACH PROTOCOL Policy 2197 Management of Personal Information APM 1450 Management of Personal

More information

Hong Kong High Court Procedure E-Discovery: Practice Direction Effective September 1, 2014

Hong Kong High Court Procedure E-Discovery: Practice Direction Effective September 1, 2014 CLIENT MEMORANDUM Hong Kong High Court Procedure E-Discovery: Practice Direction Effective September 1, 2014 August 28, 2014 Mandatory application of e-discovery Mandatory application of e-discovery to

More information