Cyber Security 1215

903 views

Published on

cyber security

Published in: Technology, Education
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
903
On SlideShare
0
From Embeds
0
Number of Embeds
7
Actions
Shares
0
Downloads
0
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide
  • Cyber Security 1215

    1. 1. Firoze Zia Hussain Former Superintendent of Police Pondicherry [email_address] 00919910333249
    2. 2. 06/06/09
    3. 3. <ul><li>Criminals and Terrorists are increasingly </li></ul><ul><li>Tech-Savvy. </li></ul><ul><li>Are We Ready? </li></ul>06/06/09
    4. 4. The Ultimate Weapon …..Cyber Warfare Command and Control Costs Economy of Scale Time Skills Competitive Weapons of 1990’s Collaboration, Communities of Interest Competitive Weapons of 2000 Speed Economy of Skill Speed Openness Collaboration Trust
    5. 5. 06/06/09
    6. 6. Digital Investigation 06/06/09
    7. 7. Cyber Weapons <ul><li>EMAIL-An email that looks like it comes directly from your bank. </li></ul><ul><li>Contains links could cause your machine to re-boot, and then send out passwords and login information.  </li></ul><ul><li>It also usually says please click on this safe link </li></ul><ul><li>VIRUS- A virus that is modifying commercial USB drives.  The virus on an infected computer modifies programs on USB drives.  </li></ul><ul><li>The infected USB drive, when connected to another computer, can automatically infect the computer and other drives.  </li></ul>06/06/09
    8. 8. What Is Electronic Evidence? <ul><li>Electronic evidence is information and data of investigative value </li></ul><ul><li>that is stored on or transmitted by an electronic device. </li></ul><ul><li>is acquired when data or physical items are collected and </li></ul><ul><li>stored for examination purposes. </li></ul><ul><li>Is often latent in the same sense as fingerprints or DNA evidence </li></ul><ul><li>Can transcend borders with ease and speed. </li></ul><ul><li>Is fragile and can be easily altered, damaged, or destroyed. </li></ul><ul><li>Is sometimes time-sensitive. </li></ul>06/06/09
    9. 9. ELECTRONIC Crime Scene Investigations <ul><li>Examination of digital evidence. </li></ul><ul><li>Investigative uses of technology. </li></ul><ul><li>Investigating electronic technology crimes. </li></ul><ul><li>Creating a digital evidence forensic unit. </li></ul><ul><li>Courtroom presentation of digital evidence </li></ul>06/06/09
    10. 10. Managing Digital Evidence in the 21st Century <ul><li>  </li></ul>06/06/09
    11. 11. 06/06/09
    12. 12. Digital Forensics <ul><li>Digital forensics is the application of science and engineering to the recovery of digital evidence in a legally acceptable method. </li></ul><ul><li>Examiners use digital investigation and analysis techniques to determine potential legal evidence by applying their skills on a variety of software programs, different operating systems, varying hard drives sizes, and specific technologies such as personal digital assistants, cell phones, or video cameras. </li></ul><ul><li>Examiners are also capable of locating deleted, encrypted or damaged file information that may serve as evidence in a criminal investigation. </li></ul>06/06/09
    13. 13. Global initiatives- California High-Technology Crime Task Forces <ul><li>The design, development, and production of this project utilizing grant funds made available from the Governor’s Office of Criminal Justice Planning. </li></ul><ul><li>Help in achieving even greater levels of success in their prosecution and convictions of those who commit high-technology crimes. </li></ul><ul><li>Legal transcripts, documents, and resource materials were selected and developed using the insight and professional experience of a team of prosecutors </li></ul>06/06/09
    14. 14. Email Tracing and Prosecutorial Enforcement Tool <ul><li>Email step-by-step tracing methodology, </li></ul><ul><li>Expert testimony, </li></ul><ul><li>Jury presentation, </li></ul><ul><li>Search warrants, and </li></ul><ul><li>State and Federal guidelines. </li></ul><ul><li>Veteran who have successfully prosecuted high-technology crimes cases instrumental in the strategy, selection of content, and production design used to address the scale and scope of this complex topic. </li></ul><ul><li>Application of this product — Informative resource tool that can be applied to a variety of cases — </li></ul>06/06/09
    15. 15.   How email works Computer Forensic Examiner <ul><li>How to Trace an Email ..Tracing methodology. </li></ul><ul><li>How an Email Travels the Internet . </li></ul><ul><li>How to Trace an IP Address . Proper IP address tracing methods. </li></ul><ul><li>How email moves over the global Internet include Anonymizers, Remailers, and Email Spoofing. </li></ul><ul><li>Request for Comments (RFCs) and other technical documents   that define protocols </li></ul><ul><li>Digital Evidence Presenting an email case to a jury involving complex topics such as digital evidence. </li></ul><ul><li>Expert testimony The following documents provide information regarding working with expert witnesses in technical cases. </li></ul><ul><li>  </li></ul>06/06/09
    16. 16. Child Pornography Cases <ul><li>Sample direct and cross-examination of a prosecution expert in the Westerfield case: State of California v. Westerfield trial (June 2002). </li></ul><ul><li>Qualifying the expert </li></ul><ul><li>Imaging hard drives; an explanation of hard drives, compact disks, zip disks, and how files are stored or copied to those media; </li></ul><ul><li>Downloading images from the Internet; </li></ul><ul><li>Presenting still images and digital movies to a jury; </li></ul><ul><li>File extensions; allocated versus unallocated space (deleted files); temporary Internet files; screen capture </li></ul><ul><li>Reviewing email stored on a suspect's computer. </li></ul>06/06/09
    17. 17. Hacking Case <ul><li>Sample direct and cross-examination of expert in a computer intrusion (hacking) case:  </li></ul><ul><li>The subject computer's clock; </li></ul><ul><li>Downloading groups of zipped files; access dates; </li></ul><ul><li>The retrieval of violent photos and poems vire programs (programs that create viruses) </li></ul><ul><li>Expert opinion regarding surfing habits of &quot;typical&quot; teenagers </li></ul><ul><li>Whether the computer owner had superior knowledge of computers and the Internet. </li></ul><ul><li>  </li></ul>06/06/09
    18. 18. Cyber InvestigationSoftware/Tools <ul><li>Steganography </li></ul><ul><li>Surveillance/Desktop Monitoring Programs </li></ul><ul><li>Security Information, Software and Utilities </li></ul><ul><li>Software Firewalls </li></ul><ul><li>Miscellaneous and Shareware </li></ul><ul><li>V. Technical Links </li></ul><ul><li>File Extensions and Formats </li></ul><ul><li>Hard Drive Removal </li></ul><ul><li>Hard Drives </li></ul><ul><li>CD-R </li></ul><ul><li>Drivers </li></ul><ul><li>VI. Internet Redirecting Sites/Services (Web Forwarding) </li></ul><ul><li>IP Addresses </li></ul><ul><li>Whois Information (Domain Name Lookup) </li></ul><ul><li>Country Codes </li></ul><ul><li>DNS Tools and More </li></ul><ul><li>Pings and Traceroutes </li></ul><ul><li>Person Searches </li></ul><ul><li>Software Links </li></ul><ul><li>Forensic Software </li></ul><ul><ul><li>Hard Drive Duplication/Examination </li></ul></ul><ul><ul><li>PDA Duplication </li></ul></ul><ul><ul><li>Data Recovery Services </li></ul></ul><ul><ul><li>Hard Drive Wiping Utilities </li></ul></ul>06/06/09
    19. 19. ONTRACK Data Recovery-Forensics <ul><li>. </li></ul><ul><li>1996 ONTRACK recovers a corporation's data that was lost when a former employee launched a computer &quot;time bomb&quot; into the company's technology infrastructure. </li></ul><ul><li>ONTRACK experts forensically investigated the source of the computer time bomb and offered expert testimony in a court of law. </li></ul><ul><li>2007 Kroll Ontrack acquires TrialGraphix, Inc., leading provider of trial consulting and presentation services, to enable law firms and corporations to engage expert for their litigation consulting and technology needs from pre-litigation preparedness, through discovery and trial.   </li></ul>06/06/09
    20. 20. ENCASE Cyber Forensic Software <ul><li>Providing complete network visibility, immediate response and comprehensive, forensic-level analysis of servers and workstations </li></ul><ul><li>Securely investigate/analyze over the LAN/WAN at the disk and memory level. </li></ul><ul><li>Limit incident impact and eliminate system downtime with immediate response capabilities. </li></ul><ul><li>Investigate and analyze multiple platforms — Windows, Linux, AIX, OS X, Solaris </li></ul><ul><li>Proactively audit systems for classified information, as well as unauthorized processes and network connections. </li></ul><ul><li>Identify fraud, security events and employee integrity issues wherever they are taking place — then investigate without alerting targets. </li></ul>06/06/09
    21. 21. Mobile Forensics <ul><li>Mobile devices are an integral part of an ever-increasing number of investigations, </li></ul><ul><li>Need to acquire evidence from mobile devices has created new and complex challenges for investigators. </li></ul><ul><li>Overview of mobile phone networks </li></ul><ul><li>Identify mobile phones </li></ul><ul><li>Learn proper seizure techniques </li></ul><ul><li>Receive an overview of mobile phone data storage </li></ul><ul><li>Acquire and examine SIM cards </li></ul><ul><li>Examine EnCase® Neutrino™ Mobile Phone Acquisition Device components </li></ul><ul><li>Acquire data from mobile devices </li></ul><ul><li>Examine the data that they have acquired </li></ul>06/06/09
    22. 22. EnCase® Legal Hold <ul><li>Evidence will be preserved in Logical Evidence File, built upon court-validated technology, hashed for full chain of custody. </li></ul><ul><li>By maintaining complete chain of custody from the moment the duty to preserve documents occurs </li></ul><ul><li>a) Conduct Early Case Assessment through a network scan for responsive documents. b) Execute track and analyze custodian acknowledgments c) Execute an Interview regarding Responsive Data from your custodians to determine where their responsive data exists d) Collecting the potentially responsive data and preserving that data in a forensically sound manner </li></ul>06/06/09
    23. 23. Image Scan Training <ul><li>This software tool was created by members of the FBI’s Computer Analysis Response Team </li></ul><ul><li>Specifically for &quot;knock & talk&quot; situations relating to child exploitation investigations. </li></ul><ul><li>Once deployed, the software quickly identifies and isolates images on a suspect’s computer </li></ul><ul><li>Stores them on a thumb drive – without altering any files on the computer. </li></ul>06/06/09
    24. 24. RCFL <ul><li>An RCFL is a one stop, full service forensics laboratory and training center devoted entirely to the examination of digital evidence in support of criminal investigations such as— </li></ul><ul><li>Terrorism </li></ul><ul><li>Child Pornography </li></ul><ul><li>Crimes of Violence </li></ul><ul><li>Trade secret theft </li></ul><ul><li>Theft or destruction to intellectual property </li></ul><ul><li>Financial crime /Property crime /Internet crimes /Fraud. </li></ul>06/06/09
    25. 25. Emerging Requirements New Initiatives Required <ul><li>Computer Forensic Science Laboratory </li></ul><ul><li>Electronic Crimes Task Force </li></ul><ul><li>Digital Evidence databank </li></ul><ul><li>Training in Cyber Security </li></ul><ul><li>Personnel------Cyber Security trained officers </li></ul><ul><li>Integrated Approach-Home land security initiative </li></ul><ul><li>INTERPOL </li></ul>06/06/09
    26. 26. INTEGRATED CYBER SECURITY APPROACH STAFF TRAINING CYBER SECURITY CENTRES INTEGRATION RECRUITMENT METHODOLOGY ON SITE OFF SITE TRAINING HARDWARE & SOFTWARE SHARING OF CRIME DATA MULTI DISCIPLINARY/ DIVERSITY APTITUDE TEST CONTINUOUS GLOBAL APPROACH DIGITAL EVIDENSE COLLECTIONN High Tech Crimes Task Force LEGISLATION/ ENFORCEMENT PROSECUTION/ FUNCTIONAL CONSULTANTS FOR INTEGRATION CYBER SECURITY COMPETENCY MATRIX
    27. 27. TRAINING CYBER SECURITY investigation GLOBAL INTEGRATION LEGISLATION CASE Management PUBLIC PRIVATE PARTNERSHIPS Strategy & Planning PROSECUTION
    28. 28. PUBLIC AWARENESS IN CYBER SECURITY INTEGRATION ACTIVITY THE – VITAL LINK
    29. 29. <ul><li>EnCase® eDiscovery v3.1 Guidance Software’s EnCase® eDiscovery is the leading eDiscovery solution for the search, identification, collection, preservation and processing of electronically stored information (ESI) across the enterprise network. The EnCase® platform enables thorough, network-enabled and court-validated computer investigations of any kind, such as responding to document requests, conducting internal investigations, responding to regulatory inquiries or performing data and compliance auditing, all while maintaining the integrity of the data. </li></ul><ul><li>Systemized, Defensible and Repeatable Process Using a systemized, defensible and repeatable process as required by the FRCP, recent case law, and similar international legal requirements, EnCase eDiscovery provides a timely, cost effective scalable eDiscovery solution for organizations of any size. </li></ul><ul><li>Court Validated eDiscovery Solution Validated by numerous courts, corporate legal departments, government agencies and law enforcement organizations worldwide, EnCase® is globally recognized as a best practice solution for eDiscovery. </li></ul><ul><li>Automated, Undetected Search & Collection EnCase® eDiscovery performs automated, undetected search and collection of ESI residing in unstructured and semi-structured data stores such as: workstations, laptops, file servers, data repositories and removable storage media without any business disruption. </li></ul><ul><li>EnCase® eDiscovery Search and Collection Criteria EnCase® eDiscovery enables users to search and analyze data based on a combination of any of the following criteria: </li></ul><ul><li>Custodians (by user name or SID) </li></ul><ul><li>Keywords (target specific content) </li></ul><ul><li>Date ranges (e.g., 2002-2006) </li></ul><ul><li>File type (e.g., .doc, .xls, .ppt) </li></ul><ul><li>Metadata (creation, last written and/or last accessed times, etc.) </li></ul><ul><li>Patterns (Any social security or credit card number) </li></ul><ul><li>Hash values (i.e., “digital fingerprints”) </li></ul>06/06/09

    ×