ISACA-Mumbai Chapter CYBER FORENSICS RAKESH M GOYAL. ([email protected])
|
|
|
- Evelyn Bates
- 10 years ago
- Views:
Transcription
1 ISACA-Mumbai Chapter CYBER FORENSICS RAKESH M GOYAL ([email protected]) DIRECTOR, CENTRE FOR RESEARCH AND PREVENTION OF COMPUTER CRIMES, (CRPCC) INDIA & MANAGING DIRECTOR, SYSMAN COMPUTERS (P) LTD., INDIA url : 28 August 2010
2 COMPUTER (CYBER / DIGITAL) FORENSICS
3 AGENDA What is Forensics What is Cyber Forensics Who uses Types and details Skills needed
4 WHAT IS FORENSICS - FORENSIC SCIENCE Forensic science (often shortened to forensics) is the application of a broad spectrum of sciences to answer questions of interest to a legal system. This may be in relation to a crime or a civil action.
5 WHAT IS FORENSICS - The use of science and technology to investigate and establish facts in criminal or civil courts of law. (Sherlock Holmes / Perry Mason / Vyomkesh Bakshi / Agatha Christie / Insp. Ghote / Feluda / Karam Chand / ACP Pradyuman)
6 WHAT IS FORENSICS Physical Sciences Forensics Fingerprint analysis Forensic accounting Ballistics Body identification DNA profiling Forensic arts Forensic toxicology Forensic footwear evidence Questioned document examination Fire investigation Vehicular accident reconstruction
7 WHAT IS FORENSICS Cyber forensics (Digital or Computer forensics) Data forensics Application forensics Network and peripherals / social-networking forensics Social Engineering forensics Mobile device forensics Other related disciplines Forensic engineering Forensic linguistics Forensic materials engineering Forensic polymer engineering
8 WHAT IS FORENSICS Physiological sciences Forensic pathology Forensic dentistry Forensic anthropology Forensic entomology Forensic archaeology Social sciences Forensic psychology Forensic psychiatry
9 WHAT IS COMPUTER FORENSICS - Computer forensics involves the 1. identification, 2. preservation, 3. extraction, 4. documentation, 5. interpretation and 6. presentation of computer data in such a way that it can be legally admissible.
10 WHAT IS COMPUTER FORENSICS - Computer Forensics - Commonly defined as the collection, preservation, analysis and court presentation of computer-related evidence. Proper Acquisition and Preservation of Computer Evidence. Authentication of Collected Data for Court Presentation Recovery of All Available Data, Including delete files.
11 The lawful and ethical seizure, acquisition, analysis, reporting and safeguarding of data and meta-data derived from digital devices which may contain information that is notable and perhaps of evidentiary value to the trier of fact in managerial, administrative, civil and criminal investigations. - Larry Leibrock, PhD
12 COMPUTER FORENSICS IS NOT - PRO-ACTIVE (SECURITY), BUT REACTIVE TO AN EVENT OR REQUEST ABOUT FINDING THE BAD GUY BUT FINDING THE EVIDENCE OF VALUE FUN IT NEEDS PROPER EXPERTISE QUICK n TERABYTE DRIVES ARE AVAILABLE (DATA UNIVERSE EXABYTE IN 2006 TO 988 EXABYTE IN 2010)
13 CRIMINALS EXPLOIT WEAK LINKS Weak Links may be - User Technology / Application Implementation Policies / Procedures JOB OF FORENSICS EXAMINER IS TO FIND WHAT, HOW, WHEN, AND WHERE
14 CONTROLS IN I.T. Over 600 controls to handle in IT environment Forensics should be geared to cater to these 600 risk
15 WHAT IS DONE GOING BACK IN TIME AND SPACE VISUALISE ALL HAPPENINGS BUILD THE CHAIN OF CUSTODY (CoC) DOCUMENT ALL OBSERVATIONS, HYPOTHESIS, METHODOLOGY, STEPS, PROCESS, ANALYSIS, REASONING, OPTIONS, CONCLUSIONS OR FINDINGS
16 OBJECTIVE FIND FACTS AND PRESENT FOR JUSTICE PROSECUTION LEGALLY ADMISSIBLE, DEFENSE MUST NOT DEMOLISH THE CASE DEFENSE FIND HOLES, WRONG REPRESENTATION, SHABBY / TEMPER PRONE INVESTIGATION / CONCLUSIONS -> BENEFIT OF DOUBT.
17 WHO USES COMPUTER FORENSICS - MANY TYPES OF CIVIL AND CRIMINAL PROCEEDING NEED USE OF COMPUTER FORENSICS EXAMINERS - CRIMINAL JUSTICE AGENCIES / SYSTEM REVENUE / ENFORCEMENT / REGULATORY DEPARTMENTS CORPORATE CHIEFS / CEO CRIMINAL / CORPORATE COUNSELS BANKS / INSURANCE COMPANIES AUDITORS INDIVIDUAL CRACKER / HACKERS
18 CRIMINAL PROSECUTION - USE COMPUTER EVIDENCE IN A VARIETY OF CRIMES WHERE INCRIMINATING DOCUMENTS CAN BE FOUND: HOMICIDES, FINANCIAL FRAUD, DRUG AND EMBEZZLEMENT, HARASSMENT, RECORDKEEPING, AND CHILD PORNOGRAPHY. CIVIL LITIGATIONS CAN READILY MAKE USE OF PERSONAL AND BUSINESS RECORDS FOUND ON COMPUTER SYSTEMS THAT BEAR ON: FRAUD, DIVORCE, DISCRIMINATION, AND HARASSMENT CASES. INSURANCE COMPANIES MAY BE ABLE TO MITIGATE COSTS BY USING DISCOVERED COMPUTER EVIDENCE OF POSSIBLE FRAUD IN ACCIDENT, ARSON, AND WORKMAN'S COMPENSATION CASES.
19 CORPORATIONS OFTEN HIRE COMPUTER FORENSICS EXAMINERS TO ASCERTAIN EVIDENCE RELATING TO FRAUDS, EMBEZZLEMENT, BLACKMAIL, SEXUAL HARASSMENT, THEFT OR MISAPPROPRIATION OF TRADE SECRETS AND OTHER INTERNAL/CONFIDENTIAL INFORMATION, HARASSMENT BY (EX)-EMPLOYEES. REVENUE / ENFORCEMENT / REGULATOR FREQUENTLY REQUIRE ASSISTANCE IN POST-SEIZURE HANDLING OF THE COMPUTER ASSETS. COUNSELS / INDIVIDUALS SOMETIMES HIRE COMPUTER FORENSICS EXAMINERS TO SUPPORT THE DEFENCE FOR CLAIMS OF WRONGFUL TERMINATION, BLACKMAIL, SEXUAL HARASSMENT OR LEGAL ACTION.
20 TYPE OF COMPUTER FORENSICS - DATA / INFORMATION NETWORK AND PERIPHERALS / WEBPAGES / SOCIAL NETWORKS SOFTWARE / APPLICATION / MALICIOUS CODE IMAGE / STEGANOGRAPHY DIGITAL IMAGE / SOUND / VIDEO / WATERMARK / ENCRYPTION COMPUTER RESOURCES DATA COMMUNICATION
21 COMPUTER FORENSICS - DATA / INFORMATION PINPOINT THE RELEVANT DATA FROM LARGE VOLUME OF DATA MULTIPLE LOCATIONS MULTIPLE SERVERS MULTIPLE DESKTOPS / NODES MULTIPLE BACKUP MEDIA / ARCHIVED DATA MULTIPLE OS / RDBMS / FILES-TYPES
22 COMPUTER FORENSICS - DATA / INFORMATION SEARCHING THE NEEDLE IN THE HAY
23 COMPUTER FORENSICS - DATA / INFORMATION ORIGINAL MEDIA NOT TO BE ALTERED TO BE MADE EXACT MIRROR IMAGE MIN. 2 BIT-BY-BIT OR SECTOR-BY-SECTOR COPY OF ORIGINAL MEDIA ALL BITS COPY NOT MOST OF THE BITS NOT BY NORMAL FILE / DIRECTOR / DISK COPY MEMORY DUMP
24 COMPUTER FORENSICS - DATA / INFORMATION COPY METHODS - AFTER MEMORY DUMP REMOVE AND MIRROR ON FORENSICS COMPUTER CONNECT IDENTICAL MEDIA AND MIRROR CONNECT THROUGH NETWORK AND MIRROR THE TOOL MUST BE ABLE TO COPY EVERY BIT IN SAME ORDER NO CHANGE IN ORIGINAL VERIFIABLE AND RESPECTABLE CHECKSUM AND ALGORITHM PROTECTION
25 COMPUTER FORENSICS - DATA RECOVERY NORMAL FILES / S HIDDEN FILES DELETED / PURGED / WIPED / ERASED FILES FILES HIDDEN IN ADDITIONAL TRACKS ATTRIBUTES AS SYSTEM / TEMP / SPOOL / RENAMED / INSTALLATION FILES / EXTENSION-CHANGED ENCRYPTED / STEGANOGRAPHED FAT ENTRY
26 DATA FORENSICS PROCESS STAGES 1) ONSITE / OFF-SITE NON-DESTRUCTIVE DATA COLLECTION, IMAGING ETC; 2) RECOVERY OF ACTIVE, HIDDEN FILES, DELETED FILES(to the extent possible), PASSWORD PROTECTED FILES, STEGANALYSIS etc. 3) ANALYSIS 4) DOCUMENTATION
27 COMPUTER FORENSICS - DATA ANALYSIS
28 COMPUTER FORENSICS -
29 COMPUTER FORENSICS - NETWORK
30 Holes In Network 1. Inadequate Router Access Control Internet Border Router 8. Mis-configured Firewall or Router Internal Router 6. User Accts with Excessive Privileges Workstation 4. Running Unnecessary Services (FTP, DNS, SMTP) Internal LAN 5. Weak or Reused Passwords 3. Information Leakage Via Zone Transfer & Services (SMTP, Telnet) Internet/DMZ/Servers 7. Mis-configured Internet Servers Mobile/home user Remote Access Servers 2. Unsecured / Unmonitored Remote Access 10. Excessive File & Directory Access Controls 9. Un-patched, Outdated Software with Default Configurations
31 NETWORK FORENSICS - Computer networks. Firewall logs NIDS logs http,ftp,. logs
32 COMPUTER FORENSICS - THREATS / OBSCENE / DEFAMATORY SPAM / FRAUDS (419 / ADVANCE FEE) / PHISHING LOADED WITH MALWARE PASSWORD HIJACKING / MAIL FORWARD WEBPAGES DEFACEMENT / DOS (or DDOS) ATTACK MALICIOUS CONTENT MALWARE DISTRIBUTOR PERSONAL INFO GRABBER
33 Tracing Headers (3) Received: from mailhost.example.com ([XXX.XXX ]) by smtp.exampl.com; Sat, 13 Sep :25: (2) Received: from web03.iname.net by mailhost.example.com (AIX 3.2/UCB 5.64/4.03) id AA07400; Sat, 13 Sep :31: (1) Received: (from by web03.iname.net (8.8.8/8.8.0) id SAA29949; Sat, 13 Sep :25: (EDT) Date: Sat, 13 Sep :25: (EDT) (4) From: fake user Message-Id: Content-Type: text/plain Mime-Version: 1.0 To: Content-Transfer-Encoding: 7bit Subject: This is a forged message
34 COMPUTER FORENSICS - TRACING ISSUES SENDER ADDRESS SPOOFED ORIGINATE FROM BOTNET / ZOMBIES NEED ISPs ACTIVE HELP (IT ACT-2000 EMPOWER POLICE FOR THAT) ACCOUNTS HACKED / HIJACKED
35 COMPUTER FORENSICS - SOFTWARE APPLICATION SOFTWARE - BUGS SYSTEM PROGRAM CODING SECURITY MALICIOUS CODE (TROJAN / TRAP DOOR / BOMB) PATCH MANAGEMENT ZERO DAY VULNERABILITIES PROCESSING LOGS
36 COMPUTER FORENSICS - SOFTWARE EXTRA / ONE TIME PROGRAMS VERSION O/S LOGS DATABASE LOGS ACCESS MANAGEMENT AND LOGS TROJANS / KEYLOGGERS / MONITORS / VIRUS / WORMS / BACK-DOORS REVERSE ENGG / WHO IS AUTHOR?
37 COMPUTER FORENSICS - IMAGE / STEGANOGRAPHY DIGITAL IMAGE / SOUND / VIDEO / WATERMARK / ENCRYPTION
38 COMPUTER FORENSICS - RECOVERY TOOL
39 COMPUTER FORENSICS - COMPUTER RESOURCES THEFT OF DIGITAL RESOURCES USING AS BOTNET / ZOMBIE REMOTE CONTROLLING MISUSAGE / UNAUTHORIZED STORAGE THEFT / DELETE / ALTERATION OF CONFIDENTIAL DATA OVERLOADING / DENIAL OF SERVICE ESTONIAIZATION
40 COMPUTER FORENSICS - COMMUNICATION TAPPING / LISTENING / SNIFFING MAN-IN-THE-MIDDLE ATTACK DECRYPTION HACKING / CRACKING FIREWALL / IDS CRACKING
41 Sources of Data
42 Sources of Data COMPUTER FORENSICS -
43 THE LAST LINE OF DEFENSE LEGAL ACTION IF EVIDENCE IS NOT HANDLED PROPERLY IT BECOMES INADMISSIBLE IN A COURT OF LAW IF THERE IS NO EVIDENCE OF A CRIME, THERE IS NO CRIME IN THE EYES OF LAW
44 CONDUCTING AN INVESTIGATION 7 STEP SYSTEM SPEED HANDLED QUICKLY TO AVOID EVIDENCE DAMAGE STEALTH INVESTIGATION QUIETLY SYSTEM SECURITY NO FURTHER DAMAGE SECURE EVIDENCE CHAIN OF CUSTODY SUSPICIOUS/SUSPECT EMPLOYEES MOST THEFTS ARE DONE BY EMPLOYEES SHOW and TELL REPORTING HOW TO MAKE REPORT UNDERSTANDABLE SEARCH WARRANTS
45 POINTS TO CONSIDER REGARDING DIGITAL EVIDENCE NO EVIDENCE IS DAMAGED, DESTROYED, OR OTHERWISE COMPROMISED BY THE PROCEDURES USED TO INVESTIGATE THE COMPUTER, EVIDENCE IS PROPERLY HANDLED, A CONTINUING CHAIN OF CUSTODY IS ESTABLISHED AND MAINTAINED, ALL PROCEDURES AND FINDINGS ARE THOROUGHLY DOCUMENTED.
46 STEPS TAKEN BY COMPUTER FORENSIC EXPERT PROTECT THE SUBJECT SYSTEM DURING EXAMINATION FROM ALTERATION, DAMAGE, DATA CORRUPTION OR VIRUS INTRODUCTION DISCOVER & RECOVER ALL FILES ACCESS THE CONTENTS OF PROTECTED OR ENCRYPTED FILES ANALYZE ALL RELEVANT DATA PRINTOUT AN OVERALL ANALYSIS PROVIDE TESTIMONY IN COURT OF LAW
47 CARDINAL RULES OF COMPUTER FORENSICS NEVER MISHANDLE EVIDENCE NEVER WORK ON ORIGINAL EVIDENCE USE PROPER SOFTWARE UTILITIES NEVER TRUST THE SUBJECT OPERATING SYSTEM DOCUMENT EVERYTHING
48 UK LEGAL GUIDELINES In order to comply with the need to maintain the integrity of digital evidence Examiners follow guidelines issued by the Association of Chief Police Officers (ACPO). The guidelines consist of four principles: 1. No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court. 2. In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.
49 UK LEGAL GUIDELINES In order to comply with the need to maintain the integrity of digital evidence Examiners follow guidelines issued by the Association of Chief Police Officers (ACPO). The guidelines consist of four principles: 3. An audit trail or other record of all processes applied to computer based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result. 4. The person in charge of the investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to.
50 SOME TOOLS EnCase FTK PTK Forensics The Sleuth Kit The Coroner's Toolkit COFEE Selective file dumper (many free/commercial) manual review of material on the media, reviewing the Windows registry for suspect information, discovering and cracking passwords, keyword searches for topics related to the crime, and extracting and pictures for review.
51 SOME TOOLS BY CDAC CyberCheck Suite Disk Forensics Tools TrueBack V3.1 on Linux Disk Imaging Tool TrueBack V1.0 on Windows Disk Imaging Tool CyberCheck V3.2 on Windows Data Recovery and Analysis Tool NetForce Suite Network Forensics Tools CyberInvestigator V1.0 on Windows Forensic Log Analyzer NeSA V1.0 on Linux Network Session Analyzer Tracer V3.0 on Windows Tool for tracing sender of
52 SOME TOOLS BY CDAC DeviceAnalyst Suite Device Forensics Tools PDA Imager & Analyzer Tool for imaging and analyzing PDA contents SIM Card Imager & Analyzer Tool for imaging and analyzing GSM SIM Cards CDR Analyzer Tool for analyzing Call Data Records Cyber Forensics Hardware Tools TrueImager High speed H/W based Disk Imaging Tool TrueLock H/W based drive lock for write protecting IDE/SATA disks
53 FORENSIC EXAMINER MUST UNDERSTAND / HAVE BUSINESS PROCESS TECHNOLOGY LAW AND LEGAL PROCESS (LOCAL/INTL) HUMAN BEHAVIOUR LATEST DEVELOPMENTS IN IT AND CRIME SCENARIO COMMON SENSE / SIXTH SENSE HUMAN RELATIONS SKILLS REPORTING / DOCUMENTATION SKILLS
54 FORENSIC CERTIFICATES CFE (CERTIFIED FRAUD EXAMINER) GCFA (GIAC CERTIFIED FORENSICS ANALYST) CCCI CCCI (CERTIFIED COMPUTER CRIMES INVESTIGATOR) CCE (CERTIFIED COMPUTER EXAMINER) CCFE (CERTIFIED COMPUTER FORENSICS EXAMINER) For network etc CCNA / CCNP etc. helps For application programming / database skill helps
55 Want to get updated on IS Security issues Subscribe to CRPCC newsletter at google-group Control-Computer-Crimes (3 times a week newsletter) subscribers Read the books - Information Technology Act 2000 Digital Signatures Case Studies in Information Security Sankat Mochan Yojana (download from Securing Wi-Fi Networks (download from
56 Rakesh Goyal (Managing Director Sysman Computers P Ltd. & Director Center for Research and Prevention of Computer Crimes) AMIE (Gold Medallist), MBA (IIMB, Gold Medallist), Chartered Engineer, Certified Management Consultant, Certified Information System Auditor (4 th rank in world), Certified Computer Crime Investigator Certified Fraud Examiner 37 yrs Industry / Consulting experience 28 yrs in IT Software Development 19 yrs in IT / Computer Security since 1991
57 Rakesh Goyal Pioneer in IT Security in India Author of the books Computer Crimes (1993), Digital Signatures (2004), I T Act-2000 (2005), Sanket Mochan Yojana (2005), Wi-Fi Security (2006) 50 articles and research papers Assignments in Computer Crimes Forensics, Investigation & Prevention since 1991 Member of committee created IT Act in India and later defining PKI standards Member of various Government and RBI committees Black belt in Karate
58 About SYSMAN Incorporated in 1985: 25 year old Firm Part Equity held by the IDBI (Premier Financial Institution of Govt. of India) One of the only 7 Empanelled Auditors under Information Technology Act, 2000 ( ) Empanelled Auditors with CERT-In, GoI Published books: COMPUTER CRIMES, CASES ON INFORMATION SYSTEMS SECURITY, Digital Signatures, I T Act-2000, Wi-Fi Security and Bank Computerisation. First Mumbai-based ISO17799 Associate Consultant of British Standards Institution, UK for Implementation of ISMS 7799.
59 About SYSMAN Registered with World Bank, Asian Dev. Bank, African Dev. Bank, Reserve Bank of India, EXIM Bank, several Large Banks etc. Over 1,900 Human Years of experience Oldest Indian IS Security Firm Completed IS Audit & IS Security Projects since 1991 Client Sectors: Banks, Multi National Corporations, Indian Corporates, Law Enforcement & Revenue Departments
60 Thank You For Your Attention. Contact : Rakesh Goyal SYSMAN COMPUTERS (P) LTD. Mumbai, India Tel: / [email protected] and [email protected] URL:
10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft)
1- A (firewall) is a computer program that permits a user on the internal network to access the internet but severely restricts transmissions from the outside 2- A (system failure) is the prolonged malfunction
Digital Forensic. A newsletter for IT Professionals. I. Background of Digital Forensic. Definition of Digital Forensic
I Digital Forensic A newsletter for IT Professionals Education Sector Updates Issue 10 I. Background of Digital Forensic Definition of Digital Forensic Digital forensic involves the collection and analysis
Indian Efforts in Cyber Forensics
Indian Efforts in Cyber Forensics B. Ramani Addl. Director 10-Feb-09 Resource Centre for Cyber Forensics 1 Presentation Overview About C-DAC Resource Centre for Cyber Forensics C-DAC Cyber Forensics Solutions
EC-Council Ethical Hacking and Countermeasures
EC-Council Ethical Hacking and Countermeasures Description This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1
MSc Computer Security and Forensics Cohort: MCSF/09B/PT Examinations for 2009-2010 / Semester 1 MODULE: COMPUTER FORENSICS & CYBERCRIME MODULE CODE: SECU5101 Duration: 2 Hours Instructions to Candidates:
Certified Cyber Security Analyst VS-1160
VS-1160 Certified Cyber Security Analyst Certification Code VS-1160 Vskills certification for Cyber Security Analyst assesses the candidate as per the company s need for cyber security and forensics. The
Information Technologies and Fraud
Information Technologies and Fraud Florin Gogoasa CISA, CFE, CGEIT, CRISC ACFE Romania - Founder and Board member Managing Partner Blue Lab Consulting Information Technologies for Fraud investigation A.
Detailed Description about course module wise:
Detailed Description about course module wise: Module 1: Basics of Networking and Major Protocols 1.1 Networks and its Types. 1.2 Network Topologies 1.3 Major Protocols and their Functions 1.4 OSI Reference
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
Computer Forensics as an Integral Component of the Information Security Enterprise
Computer Forensics as an Integral Component of the Information Security Enterprise By John Patzakis 10/28/03 I. EXECUTIVE SUMMARY In addition to fending off network intrusions and denial of service attacks,
Certified Cyber Security Analyst VS-1160
VS-1160 Certified Cyber Security Analyst Certification Code VS-1160 Vskills certification for Cyber Security Analyst assesses the candidate as per the company s need for cyber security and forensics. The
COURSE NAME: INFORMATION SECURITY INTERNSHIP PROGRAM
COURSE NAME: INFORMATION SECURITY INTERNSHIP PROGRAM Course Description This is the Information Security Training program. The Training provides you Penetration Testing in the various field of cyber world.
Information Technology Cyber Security Policy
Information Technology Cyber Security Policy (Insert Name of Organization) SAMPLE TEMPLATE Organizations are encouraged to develop their own policy and procedures from the information enclosed. Please
Information Technology Audit & Forensic Techniques. CMA Amit Kumar
Information Technology Audit & Forensic Techniques CMA Amit Kumar 1 Amit Kumar & Co. (Cost Accountants) A perfect blend of Tax, Audit & Advisory services Information Technology Audit & Forensic Techniques
ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster
Security Standards Symantec shall maintain administrative, technical, and physical safeguards for the Symantec Network designed to (i) protect the security and integrity of the Symantec Network, and (ii)
Loophole+ with Ethical Hacking and Penetration Testing
Loophole+ with Ethical Hacking and Penetration Testing Duration Lecture and Demonstration: 15 Hours Security Challenge: 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once said,
"This is a truly remarkable attack, but not. just in its scope hackers successfully. penetrated one of the most secure
ICPAK ANNUAL FORENSIC AUDIT CONFERENCE Digital Forensics in Fraud & Corruption Investigations 9 October 2014 Leisure Lodge Hotel, Diani Kenya Faith Basiye, CFE Head Group Forensic Services KCB Banking
CYBERTRON NETWORK SOLUTIONS
CYBERTRON NETWORK SOLUTIONS CybertTron Certified Ethical Hacker (CT-CEH) CT-CEH a Certification offered by CyberTron @Copyright 2015 CyberTron Network Solutions All Rights Reserved CyberTron Certified
Ethical Hacking Course Layout
Ethical Hacking Course Layout Introduction to Ethical Hacking o What is Information Security? o Problems faced by the Corporate World o Why Corporate needs Information Security? Who is a Hacker? o Type
Industry Oriented Training and Capacity Building Program on Cyber Crimes, Ethical hacking, Cyber Security, Forensics and Cyber Laws
Industry Oriented Training and Capacity Building Program on Cyber Crimes, Ethical hacking, Cyber Security, Forensics and Cyber Laws IEEE Gujarat Section In association with CLS- Cyberra Legal Services
Guidelines for Website Security and Security Counter Measures for e-e Governance Project
and Security Counter Measures for e-e Governance Project Mr. Lalthlamuana PIO, DoICT Background (1/8) Nature of Cyber Space Proliferation of Information Technology Rapid Growth in Internet Increasing Online
CRYPTUS DIPLOMA IN IT SECURITY
CRYPTUS DIPLOMA IN IT SECURITY 6 MONTHS OF TRAINING ON ETHICAL HACKING & INFORMATION SECURITY COURSE NAME: CRYPTUS 6 MONTHS DIPLOMA IN IT SECURITY Course Description This is the Ethical hacking & Information
Certified Ethical Hacker Exam 312-50 Version Comparison. Version Comparison
CEHv8 vs CEHv7 CEHv7 CEHv8 19 Modules 20 Modules 90 Labs 110 Labs 1700 Slides 1770 Slides Updated information as per the latest developments with a proper flow Classroom friendly with diagrammatic representation
Cyber Security, Cyber Crimes and Cyber Laws
Continuing Education Programme on Cyber Security, Cyber Crimes and Cyber Laws Name of the Proposer: Anil K. Roy and Manik Lal Das Other Instructors: arranged by CLS, Ahmedabad Course Objectives: Information
Digital Forensics: The aftermath of hacking attacks. AHK Committee Meeting April 19 th, 2015 Eng. Jamal Abdulhaq Logos Networking FZ LLC
Digital Forensics: The aftermath of hacking attacks AHK Committee Meeting April 19 th, 2015 Eng. Jamal Abdulhaq Logos Networking FZ LLC Topics Digital Forensics: Brief introduction Case Studies Case I:
Information Security By Bhupendra Ratha, Lecturer School of Library & Information Science D.A.V.V., Indore E-mail:[email protected] Outline of Information Security Introduction Impact of information Need
A Database Security Management White Paper: Securing the Information Business Relies On. November 2004
A Database Security Management White Paper: Securing the Information Business Relies On November 2004 IPLocks, Inc. 441-A W. Trimble Road, San Jose, CA 95131 USA A Database Security Management White Paper:
SECURING YOUR SMALL BUSINESS. Principles of information security and risk management
SECURING YOUR SMALL BUSINESS Principles of information security and risk management The challenge Information is one of the most valuable assets of any organization public or private, large or small and
e-discovery Forensics Incident Response
e-discovery Forensics Incident Response NetSecurity Corporation 21351 Gentry Drive Suite 230 Dulles, VA 20166 VA DCJS # 11-5605 Phone: 703.444.9009 Toll Free: 1.866.664.6986 Web: www.netsecurity.com Email:
information security and its Describe what drives the need for information security.
Computer Information Systems (Forensics Classes) Objectives for Course Challenges CIS 200 Intro to Info Security: Includes managerial and Describe information security and its critical role in business.
A Decision Maker s Guide to Securing an IT Infrastructure
A Decision Maker s Guide to Securing an IT Infrastructure A Rackspace White Paper Spring 2010 Summary With so many malicious attacks taking place now, securing an IT infrastructure is vital. The purpose
NEW JERSEY STATE POLICE EXAMPLES OF CRIMINAL INTENT
Appendix A to 11-02-P1-NJOIT NJ OFFICE OF INFORMATION TECHNOLOGY P.O. Box 212 www.nj.gov/it/ps/ 300 Riverview Plaza Trenton, NJ 08625-0212 NEW JERSEY STATE POLICE EXAMPLES OF CRIMINAL INTENT The Intent
Case Study: Hiring a licensed Security Provider
Case Study: Hiring a licensed Security Provider Company Profile McCann Investigations is a full service private investigation firm providing complete case solutions by employing cutting-edge computer forensics
Everything You Wanted to Know about DISA STIGs but were Afraid to Ask
Everything You Wanted to Know about DISA STIGs but were Afraid to Ask An EiQ Networks White Paper 2015 EiQ Networks, Inc. All Rights Reserved. EiQ, the EiQ logo, the SOCVue logo, SecureVue, ThreatVue,
Common Cyber Threats. Common cyber threats include:
Common Cyber Threats: and Common Cyber Threats... 2 Phishing and Spear Phishing... 3... 3... 4 Malicious Code... 5... 5... 5 Weak and Default Passwords... 6... 6... 6 Unpatched or Outdated Software Vulnerabilities...
SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)
UNIVERSITY OF PITTSBURGH POLICY SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) DATE: March 18, 2005 I. SCOPE This
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student
Certified Digital Forensics Examiner
Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student
Promoting Network Security (A Service Provider Perspective)
Promoting Network Security (A Service Provider Perspective) Prevention is the Foundation H S Gupta DGM (Technical) Data Networks, BSNL [email protected] DNW, BSNL 1 Agenda Importance of Network Security
CEH Version8 Course Outline
CEH Version8 Course Outline Module 01: Introduction to Ethical Hacking Information Security Overview Information Security Threats and Attack Vectors Hacking Concepts Hacking Phases Types of Attacks Information
Threat Events: Software Attacks (cont.)
ROOTKIT stealthy software with root/administrator privileges aims to modify the operation of the OS in order to facilitate a nonstandard or unauthorized functions unlike virus, rootkit s goal is not to
An overview of IT Security Forensics
An overview of IT Security Forensics Manu Malek, Ph.D. Stevens Institute of Technology [email protected] www.cs.stevens.edu/~mmalek April 2008 IEEE Calif. 1 Outline Growing Threats/Attacks Need for Security
The FBI Cyber Program. Bauer Advising Symposium //UNCLASSIFIED
The FBI Cyber Program Bauer Advising Symposium October 11, 2012 Today s Agenda What is the threat? Who are the adversaries? How are they attacking you? What can the FBI do to help? What can you do to stop
Introduction to Data Forensics. Jeff Flaig, Security Consultant January 15, 2014
Introduction to Data Forensics Jeff Flaig, Security Consultant January 15, 2014 WHAT IS COMPUTER FORENSICS Computer forensics is the process of methodically examining computer media (hard disks, diskettes,
FORBIDDEN - Ethical Hacking Workshop Duration
Workshop Course Module FORBIDDEN - Ethical Hacking Workshop Duration Lecture and Demonstration : 15 Hours Security Challenge : 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once
Cyber Security In High-Performance Computing Environment Prakashan Korambath Institute for Digital Research and Education, UCLA July 17, 2014
Cyber Security In High-Performance Computing Environment Prakashan Korambath Institute for Digital Research and Education, UCLA July 17, 2014 Introduction: Cyber attack is an unauthorized access to a computer
Security Awareness For Server Administrators. State of Illinois Central Management Services Security and Compliance Solutions
Security Awareness For Server Administrators State of Illinois Central Management Services Security and Compliance Solutions Purpose and Scope To present a best practice approach to securing your servers
Data Access Request Service
Data Access Request Service Guidance Notes on Security Version: 4.0 Date: 01/04/2015 1 Copyright 2014, Health and Social Care Information Centre. Introduction This security guidance is for organisations
Alexander Nikov. 9. Information Assurance and Security, Protecting Information Resources. Learning Objectives. You re on Facebook? Watch Out!
INFO 1500 Information Technology Fundamentals Learning Objectives 9. Information Assurance and Security, Protecting Information Resources Alexander Nikov Explain why information systems are vulnerable
Network Security: 30 Questions Every Manager Should Ask. Author: Dr. Eric Cole Chief Security Strategist Secure Anchor Consulting
Network Security: 30 Questions Every Manager Should Ask Author: Dr. Eric Cole Chief Security Strategist Secure Anchor Consulting Network Security: 30 Questions Every Manager/Executive Must Answer in Order
Content Teaching Academy at James Madison University
Content Teaching Academy at James Madison University 1 2 The Battle Field: Computers, LANs & Internetworks 3 Definitions Computer Security - generic name for the collection of tools designed to protect
The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices
The Proper Acquisition, Preservation, & Analysis of Computer Evidence: Guidelines & Best-Practices Introduction As organizations rely more heavily on technology-based methods of communication, many corporations
Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
Basics of Internet Security
Basics of Internet Security Premraj Jeyaprakash About Technowave, Inc. Technowave is a strategic and technical consulting group focused on bringing processes and technology into line with organizational
Hands-On How-To Computer Forensics Training
j8fm6pmlnqq3ghdgoucsm/ach5zvkzett7guroaqtgzbz8+t+8d2w538ke3c7t 02jjdklhaMFCQHihQAECwMCAQIZAQAKCRDafWsAOnHzRmAeAJ9yABw8v2fGxaq skeu29sdxrpb25zidxpbmznogtheories...ofhilz9e1xthvqxbb0gknrc1ng OKLbRXF/j5jJQPxXaNUu/It1TQHSiyEumrHNsnn65aUMPnrbVOVJ8hV8NQvsUE
Chapter 11 Manage Computing Securely, Safely and Ethically. Discovering Computers 2012. Your Interactive Guide to the Digital World
Chapter 11 Manage Computing Securely, Safely and Ethically Discovering Computers 2012 Your Interactive Guide to the Digital World Objectives Overview Define the term, computer security risks, and briefly
Scene of the Cybercrime Second Edition. Michael Cross
Scene of the Cybercrime Second Edition Michael Cross Chapter 1 Facing the Cybercrime Problem Head-On 1 Introduction 2 Defining Cybercrime 2 Understanding the Importance of Jurisdictional Issues 3 Quantifying
ITSC Training Courses Student IT Competence Programme SIIS1 Information Security
ITSC Training Courses Student IT Competence Programme SI1 2012 2013 Prof. Chan Yuen Yan, Rosanna Department of Engineering The Chinese University of Hong Kong SI1-1 Course Outline What you should know
Cybercrime in Canadian Criminal Law
Cybercrime in Canadian Criminal Law Sara M. Smyth, LL.M., Ph. D. Member of the Law Society of British Columbia CARSWELL Table of Contents Preface Table of Cases v xvii PART ONE Introduction to Cybercrime
If you know the enemy and know yourself, you need not fear the result of a hundred battles.
Rui Pereira,B.Sc.(Hons),CIPS ISP/ITCP,CISSP,CISA,CWNA/CWSP,CPTE/CPTC Principal Consultant, WaveFront Consulting Group [email protected] 1 (604) 961-0701 If you know the enemy and know yourself, you
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,
Incident Response and Computer Forensics
Incident Response and Computer Forensics James L. Antonakos WhiteHat Forensics Incident Response Topics Why does an organization need a CSIRT? Who s on the team? Initial Steps Detailed Project Plan Incident
The Information Security Problem
Chapter 10 Objectives Describe the major concepts and terminology of EC security. Understand phishing and its relationship to financial crimes. Describe the information assurance security principles. Identify
How To Get A Computer Hacking Program
CHFI v8(computer Hacking Forensics Investigator) Course Description & Overview Overview CHFIv8 Course Description EC-Council releases the brand new Version 8 of the Computer Hacking Forensics Investigator
Forensics source: Edward Fjellskål, NorCERT, Nasjonal sikkerhetsmyndighet (NSM)
s Unix Definition of : Computer Coherent application of a methodical investigatory techniques to solve crime cases. Forensics source: Edward Fjellskål, NorCERT, Nasjonal sikkerhetsmyndighet (NSM) s Unix
SECURING INFORMATION SYSTEMS
SECURING INFORMATION SYSTEMS (November 9, 2015) BUS3500 - Abdou Illia - Fall 2015 1 LEARNING GOALS Understand security attacks preps Discuss the major threats to information systems. Discuss protection
Cyber Security and Critical Information Infrastructure
Cyber Security and Critical Information Infrastructure Dr. Gulshan Rai Director General Indian Computer Emergency Response Team (CERT- In) grai [at] cert-in.org.in The Complexity of Today s Network Changes
Chapter 7 Securing Information Systems
1 Chapter 7 Securing Information Systems LEARNING TRACK 3: COMPUTER FORENSICS For thirty years, a serial murderer known as the BTK killer (standing for bind, torture, and kill) remained at large in Wichita,
Certified Digital Forensics Examiner
Cyber Security Training & Consulting Certified Digital COURSE OVERVIEW 5 Days 40 CPE Credits $3,000 Digital is the investigation and recovery of data contained in digital devices. This data is often the
Codes of Connection for Devices Connected to Newcastle University ICT Network
Code of Connection (CoCo) for Devices Connected to the University s Author Information Security Officer (Technical) Version V1.1 Date 23 April 2015 Introduction This Code of Connection (CoCo) establishes
Lectures 9 Advanced Operating Systems Fundamental Security. Computer Systems Administration TE2003
Lectures 9 Advanced Operating Systems Fundamental Security Computer Systems Administration TE2003 Lecture overview At the end of lecture 9 students can identify, describe and discuss: Main factors while
Network Security: Introduction
Network Security: Introduction 1. Network security models 2. Vulnerabilities, threats and attacks 3. Basic types of attacks 4. Managing network security 1. Network security models Security Security has
DATA PROTECTION LAWS OF THE WORLD. India
DATA PROTECTION LAWS OF THE WORLD India Date of Download: 6 February 2016 INDIA Last modified 27 January 2016 LAW IN INDIA There is no specific legislation on privacy and data protection in India. However,
Information Security Basic Concepts
Information Security Basic Concepts 1 What is security in general Security is about protecting assets from damage or harm Focuses on all types of assets Example: your body, possessions, the environment,
Where every interaction matters.
Where every interaction matters. Peer 1 Vigilant Web Application Firewall Powered by Alert Logic The Open Web Application Security Project (OWASP) Top Ten Web Security Risks and Countermeasures White Paper
Computer Forensics Preparation
Computer Forensics Preparation This lesson covers Chapters 1 and 2 in Computer Forensics JumpStart, Second Edition. OBJECTIVES When you complete this lesson, you ll be able to Discuss computer forensics
Bendigo and Adelaide Bank Ltd Security Incident Response Procedure
Bendigo and Adelaide Bank Ltd Security Incident Response Procedure Table of Contents 1 Introduction...1 2 Incident Definition...2 3 Incident Classification...2 4 How to Respond to a Security Incident...4
Managed Security Services
Managed Security Services 1 Table of Contents Possible Security Threats 3 ZSL s Security Services Model 4 Managed Security 4 Monitored Security 5 Self- Service Security 5 Professional Services 5 ZSL s
Computer Forensics US-CERT
Computer Forensics US-CERT Overview This paper will discuss the need for computer forensics to be practiced in an effective and legal way, outline basic technical issues, and point to references for further
"This is a truly remarkable attack, but not. just in its scope hackers successfully. penetrated one of the most secure
ICPAK ANNUAL FORENSIC AUDIT CONFERENCE Digital Forensics in Fraud & Corruption Investigations 9 October 2014 Leisure Lodge Hotel, Diani Kenya Faith Basiye, CFE Head Group Forensic Services KCB Banking
System Security Policy Management: Advanced Audit Tasks
System Security Policy Management: Advanced Audit Tasks White Paper October 6, 2005 2005 Altiris Inc. All rights reserved. ABOUT ALTIRIS Altiris, Inc. is a pioneer of IT lifecycle management software that
Country Case Study on Incident Management Capabilities CERT-TCC, Tunisia
Country Case Study on Incident Management Capabilities CERT-TCC, Tunisia Helmi Rais CERT-TCC Team Manager National Agency for Computer Security, Tunisia [email protected] [email protected] Framework
FKCC AUP/LOCAL AUTHORITY
FKCC AUP/LOCAL AUTHORITY The information contained in this section has its basis in Public Law 93.380. It is further enhanced however, by Florida State Board of Education Administrative Rule 6A-14.51 and
How To Protect Your Network From Attack From A Hacker On A University Server
Network Security: A New Perspective NIKSUN Inc. Security: State of the Industry Case Study: Hacker University Questions Dave Supinski VP of Regional Sales [email protected] Cell Phone 215-292-4473 www.niksun.com
How Security Testing can ensure Your Mobile Application Security. Yohannes, CEHv8, ECSAv8, ISE, OSCP(PWK) Information Security Consultant
How Security Testing can ensure Your Mobile Application Security Yohannes, CEHv8, ECSAv8, ISE, OSCP(PWK) Information Security Consultant Once More Consulting & Advisory Services IT Governance IT Strategic
Achieving Truly Secure Cloud Communications. How to navigate evolving security threats
Achieving Truly Secure Cloud Communications How to navigate evolving security threats Security is quickly becoming the primary concern of many businesses, and protecting VoIP vulnerabilities is critical.
When a student leaves this intensive 5 day class they will have hands on understanding and experience in Ethical Hacking.
Ethical Hacking and Countermeasures Course Description: This class will immerse the student into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
Research Topics in the National Cyber Security Research Agenda
Research Topics in the National Cyber Security Research Agenda Trust and Security for our Digital Life About this document: This document summarizes the research topics as identified in the National Cyber
Network and Host-based Vulnerability Assessment
Network and Host-based Vulnerability Assessment A guide for information systems and network security professionals 6600 Peachtree-Dunwoody Road 300 Embassy Row Atlanta, GA 30348 Tel: 678.443.6000 Toll-free:
Thanks for showing interest in Vortex IIT Delhi & What After College (WAC) Ethical Hacking Workshop.
Thanks for showing interest in Vortex IIT Delhi & What After College (WAC) Ethical Hacking Workshop. Our aim is to address the students apprehensions and anxieties regarding their career prospects in Ethical
A practical guide to IT security
Data protection A practical guide to IT security Ideal for the small business The Data Protection Act states that appropriate technical and organisational measures shall be taken against unauthorised or
EC-Council. Certified Ethical Hacker. Program Brochure
EC-Council C Certified E Ethical Hacker Program Brochure Course Description The (CEH) program is the core of the most desired information security training system any information security professional
Fundamentals of Information Systems Security Unit 1 Information Systems Security Fundamentals
Fundamentals of Information Systems Security Unit 1 Information Systems Security Fundamentals Learning Objective Explain the concepts of information systems security (ISS) as applied to an IT infrastructure.
Overview of Computer Forensics
Overview of Computer Forensics Don Mason, Associate Director National Center for Justice and the Rule of Law University of Mississippi School of Law [These materials are based on 4.3.1-4.3.3 in the National
FRONT RUNNER DIPLOMA PROGRAM INFORMATION SECURITY Detailed Course Curriculum Course Duration: 6 months
FRONT RUNNER DIPLOMA PROGRAM INFORMATION SECURITY Detailed Course Curriculum Course Duration: 6 months MODULE: INTRODUCTION TO INFORMATION SECURITY INFORMATION SECURITY ESSENTIAL TERMINOLOGIES SECURITY
9. Information Assurance and Security, Protecting Information Resources. Janeela Maraj. Tutorial 9 21/11/2014 INFO 1500
INFO 1500 9. Information Assurance and Security, Protecting Information Resources 11. ecommerce and ebusiness Janeela Maraj Tutorial 9 21/11/2014 9. Information Assurance and Security, Protecting Information
March 2012 www.tufin.com
SecureTrack Supporting Compliance with PCI DSS 2.0 March 2012 www.tufin.com Table of Contents Introduction... 3 The Importance of Network Security Operations... 3 Supporting PCI DSS with Automated Solutions...