Scene Of The Cybercrime


Published on

Published in: Business, Education
1 Like
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Scene Of The Cybercrime

  1. 1. Scene of the Cybercrime: Assisting Law Enforcement In Tracking Down and Prosecuting Cybercriminals
  2. 2. Please allow me to introduce myself … <ul><li>Debra Littlejohn Shinder, MCSE </li></ul><ul><ul><li>Former police sergeant/police academy and college criminal justice instructor </li></ul></ul><ul><ul><li>Technical trainer </li></ul></ul><ul><ul><ul><li>Networking, operating systems, IT security </li></ul></ul></ul><ul><ul><li>Author </li></ul></ul><ul><ul><ul><li>Cisco Press, Syngress Media, Que, New Riders </li></ul></ul></ul><ul><ul><ul><li>TechRepublic, CNET, Cramsession/Brainbuzz </li></ul></ul></ul><ul><ul><li>Consultant </li></ul></ul><ul><ul><ul><li>Businesses and government agencies </li></ul></ul></ul>
  3. 3. What I’m going to talk about today <ul><li>What is cybercrime and is it really a problem? </li></ul><ul><li>Who are the cybercriminals? </li></ul><ul><li>Why should you want to help law enforcement officers catch them? </li></ul><ul><li>The Great Governmental Divide </li></ul><ul><li>How techies can build a bridge </li></ul><ul><li>Building the cybercrime case </li></ul>
  4. 4. Civil vs. Criminal Law <ul><li>Two separate systems of law </li></ul><ul><li>What are the differences? </li></ul><ul><li>Double jeopardy doesn’t apply </li></ul><ul><li>Constitutional protections – when do they apply? </li></ul>Breach of contract is not a crime – except when it is.
  5. 5. Defining cybercrime <ul><li>Cybercrime is any illegal act committed using a computer network (especially the Internet). </li></ul><ul><li>Cybercrime is a subset of computer crime. </li></ul>What do we mean by “illegal?” Bodies of law: Criminal, civil and administrative
  6. 6. Who are the cybercriminals? <ul><li>It’s not just about hackers </li></ul><ul><li>Using the ‘Net as a tool of the crime </li></ul><ul><ul><li>White collar crime </li></ul></ul><ul><ul><li>Computer con artists </li></ul></ul><ul><ul><li>Hackers, crackers and network attackers </li></ul></ul><ul><li>Incidental cybercriminals </li></ul><ul><li>Accidental cybercriminals </li></ul><ul><li>Situational cybercriminals </li></ul>
  7. 7. Who are the cybervictims? <ul><li>Companies </li></ul><ul><ul><li>Security? What’s that? </li></ul></ul><ul><ul><li>Bottom liners </li></ul></ul><ul><li>Individuals </li></ul><ul><ul><li>Naive/Newbies </li></ul></ul><ul><ul><li>Desparados </li></ul></ul><ul><ul><li>Pseudovictims </li></ul></ul><ul><ul><li>In the wrong place at the wrong time </li></ul></ul><ul><li>Society </li></ul>
  8. 8. Who are the cyberinvestigators? <ul><li>IT professionals </li></ul><ul><li>Corporate security personnel </li></ul><ul><li>Private investigators </li></ul><ul><li>Law enforcement </li></ul>Ultimate destination This is where the authority lies How can all Work together? When and why the police should be Called in
  9. 9. What’s in it for me? <ul><li>Why should IT personnel cooperate with police in catching cybercriminals? </li></ul><ul><li>What are the advantages? </li></ul><ul><li>What are the disadvantages? </li></ul>What are the legalities? What happens if you don’t cooperate?
  10. 10. The Great (Governmental) Divide <ul><li>Law enforcement culture </li></ul><ul><ul><li>Highly regulated </li></ul></ul><ul><ul><li>Paramilitary (emphasis on “para”) </li></ul></ul><ul><ul><li>“ By the book” </li></ul></ul>The “Police Power” myth Weight of law agency policy political factors Public relations
  11. 11. Police Secrets <ul><li>Most officers are not as confident as they appear </li></ul><ul><ul><li>Command presence required </li></ul></ul><ul><ul><li>The bluff is in </li></ul></ul><ul><li>Most cops feel pretty powerless </li></ul><ul><ul><li>Cops don’t like feeling powerless </li></ul></ul><ul><li>Most cops don’t understand technology </li></ul><ul><ul><li>Cops don’t like not understanding </li></ul></ul>
  12. 12. This leads to… <ul><li>A touch of paranoia </li></ul><ul><li>“Us vs. Them” attitude </li></ul><ul><ul><li>Cops against the world </li></ul></ul><ul><li>The truth about the thin blue line </li></ul><ul><li>The blue wall of silence </li></ul>Best kept secret: Cops are human beings
  13. 13. Why cops and techies don’t mix <ul><li>Lifestyle differences </li></ul><ul><li>Elitist mentality – on both sides </li></ul><ul><li>Adversarial relationship </li></ul><ul><ul><li>Many techies support or at least admire talented hackers </li></ul></ul><ul><ul><li>It’s human nature to protect “your own” </li></ul></ul><ul><ul><li>Many cops don’t appreciate the difference between white and black hat </li></ul></ul><ul><ul><li>Bad laws </li></ul></ul>
  14. 14. What cops and techies have in common <ul><li>Long, odd hours </li></ul><ul><li>Caffeine addiction </li></ul><ul><li>Dedication to/love of job </li></ul><ul><li>Want things to “make sense” </li></ul><ul><li>Problem solvers by nature </li></ul>What can tech people do to solve the problem of how to work with law enforcement?
  15. 15. Building team spirit <ul><li>Ability to “think like the criminal” </li></ul><ul><ul><li>Important element of good crime detection </li></ul></ul><ul><ul><li>Difficult for LE when they don’t know the technology </li></ul></ul><ul><li>IT’s role </li></ul><ul><ul><li>You know the hacker mindset </li></ul></ul><ul><ul><li>You know what can and can’t be done with the technology </li></ul></ul><ul><ul><li>You know where to look for the clues </li></ul></ul>Police know – or should know – law, rules of evidence, case building, court testimony
  16. 16. Bridging the Gap <ul><li>“ Talk the talk” </li></ul><ul><ul><li>Technotalk vs police jargon </li></ul></ul><ul><li>Learn the concepts </li></ul><ul><ul><li>Legal </li></ul></ul><ul><ul><li>Investigative procedure </li></ul></ul><ul><li>Understand the “protocols” </li></ul><ul><ul><li>“ Unwritten rules” </li></ul></ul>
  17. 17. Building the Case <ul><li>Detection techniques </li></ul><ul><li>Collecting and preserving digital evidence </li></ul><ul><li>Factors that complicate prosecution </li></ul><ul><li>Overcoming the obstacles </li></ul>
  18. 18. Cybercrime Detection Techniques <ul><li>Auditing/log files </li></ul><ul><li>Firewall logs and reports </li></ul><ul><li>Email headers </li></ul><ul><li>Tracing domain name/IP addresses </li></ul><ul><li>IP spoofing/anti-detection techniques </li></ul>
  19. 19. Collecting and Preserving Digital Evidence <ul><li>File recovery </li></ul><ul><li>Preservation of evidence </li></ul><ul><li>Intercepting transmitted data </li></ul><ul><li>Documenting evidence recovery </li></ul><ul><li>Legal issues </li></ul><ul><ul><li>Search and seizure laws </li></ul></ul><ul><ul><li>Privacy rights </li></ul></ul><ul><ul><li>Virtual “stings” (honeypots/honeynets) </li></ul></ul>Is it entrapment?
  20. 20. Factors that complicate prosecution of cybercrime <ul><li>Difficulty in defining the crime </li></ul><ul><li>Jurisdictional issues </li></ul><ul><li>Chain of custody issues </li></ul><ul><li>Overcoming obstacles </li></ul>Lack of understanding of technology (by courts/juries) Lack of understanding of law (by IT industry)
  21. 21. Difficulty in defining the crime <ul><li>CJ theory </li></ul><ul><ul><li>mala in se </li></ul></ul><ul><ul><li>mala prohibita </li></ul></ul><ul><li>Elements of the offense </li></ul><ul><li>Defenses and exceptions </li></ul><ul><li>Burden of proof </li></ul><ul><li>Level of proof </li></ul>Civil vs. criminal law Statutory, Case and Common Law
  22. 22. Jurisdictional issues <ul><li>Defining jurisdiction </li></ul><ul><li>Jurisdiction of law enforcement agencies </li></ul><ul><li>Jurisdiction of courts </li></ul><ul><li>Types of jurisdictional authority </li></ul><ul><li>Level of jurisdiction </li></ul>
  23. 23. Chain of Custody <ul><li>What is the chain of custody? </li></ul><ul><li>Why does it matter? </li></ul><ul><li>How is it documented? </li></ul><ul><li>Where do IT people fit in? </li></ul>
  24. 24. Overcoming the obstacles <ul><li>Well defined roles and responsibilities </li></ul><ul><li>The prosecution “team” </li></ul><ul><ul><li>Law enforcement officers </li></ul></ul><ul><ul><li>Prosecutors </li></ul></ul><ul><ul><li>Judges </li></ul></ul><ul><ul><li>Witnesses </li></ul></ul>What can CEOs and IT managers do?
  25. 25. Testifying in a cybercrimes case <ul><li>Expert vs evidentiary witness </li></ul><ul><li>Qualification as an expert </li></ul><ul><li>Testifying as an evidentiary witness </li></ul><ul><li>Cross examination tactics </li></ul>Three types of evidence: Physical evidence Intangible evidence Direct evidence
  26. 26. Summing it up <ul><li>Cybercrime is a major problem – and growing </li></ul><ul><li>Cybercrime is about much more than hackers </li></ul><ul><li>There is a natural adversarial relationship between IT and police </li></ul><ul><li>Successful prosecution of cybercrime must be a team effort </li></ul><ul><li>IT personnel must learn investigation and police must learn technology </li></ul>
  27. 27. The book: Defining and Categorizing Cybercrime A Brief History of the Rise of Cybercrime Understanding the People on the Scene of the Cybercrime Understanding Computer and Networking Basics Understanding Network Intrusions and Attacks Understanding Cybercrime Prevention Implementing System Security Implementing Cybercrime Detection Techniques Collecting and Preserving Digital Evidence Understanding Laws Pertaining to Computer Crimes Building and Prosecuting the Cybercrime Case Training the Cybercrime Fighters of the Future Scene of the Cybercrime by Debra Littlejohn Shinder