Catching Al Capone : What All Accountants Should Know About Computer Forensics

ScarfaceScarface

Eliot Ness

Catching Al Capone Capone was known to be responsible for a wide array of felonies and violent crimes but evidence was lacking Witnesses tended to disappear Direct evidence was needed Business records provide direct evidence Careful search, analysis, and handling of data are required to produce data that are acceptable as evidence 5

Survey Shows Companies Fear Fraud, But Many Not Prepared Ernst & Young's 9th Global Fraud Survey: Fraud Risk in Emerging Markets 60 percent of multinationals say they believe fraud is more likely to occur in emerging market operations than developed markets Robust internal controls remain the first line of defense against fraud for companies in all markets 6

8 Why Accountants and auditors … are better positioned to detect computer based fraud can assist in maintaining a chain-of-custody for digital evidence can better communicate with IT employees can promote IT-based internal controls can assist in the efficient use of IT resources

9 How Accountants and auditors … participate in setting and evaluating internal controls are trained in digital forensic technique – recovery of data, analysis of data develop an increased level of understanding of networks, databases, and information systems can maintain a chain of custody over digital evidence can interpret transaction logs

10 Caveat Accountants and auditors are not … responsible for IS or the efficient use of IT resources responsible for uncovering all instances of corporate fraud responsible for digital recovery of information

11 AICPA Top 10 Technologies Information Security Management 2. IT Governance 3. Business Continuity Management (BCM) and Disaster Recovery Planning (DRP) 4. Privacy Management 5. Business Process Improvement (BPI), Workflow and Process Exception Alerts 6. Identity and Access Management 7. Conforming to Assurance and Compliance Standards 8. Business Intelligence 9. Mobile and Remote Computing 10. Document, Forms, Content and Knowledge Management

Common Applications of Computer Forensics Employee internet abuse  common, but decreasing Unauthorized disclosure of corporate information and data  accidental and intentional Industrial espionage Damage assessment Criminal fraud and deception cases 12

ISO Standards to "provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an Information Security Management System" "established guidelines and general principles for initiating, implementing, maintaining, and improving information security management within an organization". 13

Cardinal Rules of Evidence Handling Only use tools and methods that have been tested and evaluated to validate their accuracy and reliability. Handle the original evidence as little as possible to avoid changing the data. Establish and maintain the chain of custody. Document everything done. Never exceed personal knowledge 14

Types of Audits Public (aka External or Financial) Management Operating Information Technology Compliance Fraud 15

Forensic Accountants are Involved In Criminal Investigations Shareholders' and Partnership Disputes Personal Injury Claims Business Interruption Fraud Investigations Matrimonial Disputes Professional Negligence Mediation and Arbitration 16

Computer forensics can be defined as the collection and analysis of data from computersystems, networks, communication streams (wireless) and storage media in a manner that is admissible in a court of law. -CERT 17

“Computer forensics” can thus not afford solely to concern itself with procedures and methods of handling computers, the hardware from which they are made up and the files they contain. The ultimate aim of forensic investigation is use in legal proceedings [Mandia 01]. The objective in computer forensics is quite straightforward. It is to recover, analyze and present computer based material in such a way that it is useable as evidence in a court of law [Mandia 01].

19 Digital Crime Scene Investigation Digital Forensic Investigation A process that uses science and technology to examine digital objects and that develops and tests theories, which can be entered into a court of law, to answer questions about events that occurred. IT Forensic Techniques are used to capture and analyze electronic data and develop theories.

20 Audit Goals of a Forensic Investigation Uncover fraudulent or criminal cyber activity Isolate evidentiary matter (freeze scene) Document the scene Create a chain-of-custody for evidence Reconstruct events and analyze digital information Communicate results

21 Audit Goals of a Forensic Investigation Immediate Response Shut down computer (pull plug) Bit-stream mirror-image of data Begin a traceback to identify possible log locations Contact system administrators on intermediate sites to request log preservation Contain damage and stop loss Collect local logs Begin documentation

22 Audit Goals of a Forensic Investigation Continuing Investigation Implement measures to stop further loss Communicate to management and audit committee regularly Analyze copy of digital files Ascertain level and nature of loss Identify perpetrator(s) Develop theories about motives Maintain chain-of-custody

23 Digital Crime Scene Investigation Scene Preservation & Documentation Goal: Preserve the state of as many digital objects as possible and document the crime scene. Methods:  Shut system down  Unplug (best)  Do nothing Bag and tag

24 Audit Goals of a Forensic Investigation Requirements for Evidence Computer logs … Must not be modifiable Must be complete Appropriate retention rules

25 Digital Crime Scene Investigation Problems with Digital Investigation Timing essential – electronic evidence volatile Auditor may violate rules of evidence NEVER work directly on the evidence Skills needed to recover deleted data or encrypted data

26 Digital Crime Scene Investigation Extract, process, interpret Work on the imaged data or “safe copy” Data extracted may be in binary form Process data to convert it to understandable form  Reverse-engineer to extract disk partition information, file systems, directories, files, etc  Software available for this purpose Interpret the data – search for key words, phrases, etc.

27 Digital Crime Scene Investigation Technology Magnetic disks contain data after deletion Overwritten data may still be salvaged Memory still contains data after switch-off Swap files and temporary files store data Most OS’s perform extensive logging (so do network routers)

Role of a First Responder Essentially the first person notified and reacting to the security incident Responsibilities: Determine the severity of the incident Collect as much information about the incident as possible Document all findings Share this collected information to determine the root cause 28

Importance of Computer Forensics to Accountants First Responder IT Auditor Member of CERT Maintain Chain-of-Evidence Document Scene Develop Investigatory Process Manage Investigatory Process Advanced Certifications (CISA etc) 29

30 A PDF file opened in a Hex Editor

31 A PDF file opened in NotePad

32 A BMP file opened in a Hex Editor

33 A JPG file opened in a Hex Editor

An Introduction to Computer Auditing “There is nothing more difficult to plan, more doubtful of success, nor more dangerous to manage than the creation of a new system” ~ Machievelli. 34

Project Management The basic principles of good project management are: clearly defined management responsibility clear objectives and scope effective planning and control clear lines of accountability 35

Project Management Triad: Scope, Cost, Timeline Must have top management sponsor Reports to a steering committee Timeline contains milestones Project team includes accountants End-user support critical Buy or develop software decision Must have project methodology 36

Items of Audit Interest Design methodology System controls  Close backdoors Adequate user training Steering committee to monitor progress 37

Controls General Controls Security Change Management Disaster Recovery Application Controls Data Input Controls Processing Controls Output Controls 38

Controls (cont.) Access Controls Encryption (Private and Public Key Systems) Network Firewalls and Intrusion Detection Systems 39

Audit Tools Computer Assisted Audit Tools (CAATs) AKA Generalized Audit Software (GAS) ACL and IDEA (Analytical Tools) Excel Interrogation Tools ProDiscover (Acquisition and Investigate) EnCase (Acquisition and Investigate) Hex Editors (Investigate) 40

End Class 2 Lecture Questions? 41