INTRODUCTION Patrick Norman

World Trends Smart World – Smart Grids (Power, etc.) – Mobile – Integration between physical and digital world

World Trends Smart World – Smart Grids (Power, etc.) – Mobile – Integration between physical and digital world

By 2015, a G20 nation’s critical infrastructure will be disrupted and damaged by online sabotage. (Gartner.com)

IT Threats DDoS attacks Fraud (Add more after meeting with professor RUHI)

Cyber Gangs ①Russian Business Network ②Rock Phish Gang ③NSA ④Grey Pigeon Authors ⑤Stormworm Gang ⑥Awola Crew ⑦DRG Group ⑧South American Groups ⑨Oga

BlackHat vs. WhiteHat Hackers BlackHats Work to exploit computer systems (I intend to only give maybe 1 or two examples of each hacker and tell a brief summary of what they did) Examples Jonathan James Adrian Lamo Kevin Mitnick Kevin Poulsen Robert Tappan Morris WhiteHats “"Ethical Hackers," hired by companies to test the integrity of their systems” Examples Stephen Wozniak Tim Berners-Lee Linus Torvalds Richard Stallman Tsutomu Shimomura

Forensics Investigators Main responsibilities (Job activities) Attempting to uncover the trace of an attacker to identify him Uncovering IT System security threats Testifying in court against convicts

Importance of Computer Forensics Systems How can Computer Forensics Systems improve security Better identification of system threats to improve protective measures Catching cyber criminals will have a better effect than regular criminals because they have bots automatically generating threats (FIX THIS)

Simulation

Background of Simulation 2 Important Components: Statistical Modelling – Create models to predict random events Software – Arena – Custom code

Statistical Modelling When should this be used? To predict random events When there are one or many unknowns Key success components Large data sets Well-defined problem Structured problem

Simulation Why do we simulate? – An improved tool – Avoid taking risks When do we simulate? – Before and after an event – Certain types of problems work best Can we rely on it? – 70-90%

Simulation Inputs Use random number generators Set of rules and functions that are problem dependent Outputs How do we interpret results? “There is no perfect answer” The problem could change Further developing the model will only make it more accurate

Simulation and SDLC The 2 Most Important Steps: Design Phase Look for vulnerabilities Exhaustive test sets Identify design flaws Operations Phase Collect data Identify flaws in existing systems Improve future projects

= 0% = 60% = 0% = 40% SDLC

Software Monte Carlo Off-the-shelf Advantages Network Modelling Off-the-shelf Advantages Custom Code Advantages

Computer Forensics

Mobile Forensics Outsell PCs Harder to investigate Newly acquired need to investigate Data paths Numerous Manufacturers NIST

Tools & Techniques SIMbrush MOBILedit! TULP 2G

Network Forensics “Network forensics is the science that deals with capture, recording, and analysis of network traffic for detecting intrusions and investigating them.”

Tools & Techniques

Key Techniques IDS – Intrusion Detection System Packet Capture – Capturing data packets crossing a network Proprietary – Unique techniques developed by individual vendors Pattern Matching – Ex: Hashing

Database Forensics Internet Boom Legal Duty Database forensics as a tool

Tools & Techniques SQL Server Management Studio Express SQL CMD Windows Forensic Tool Chest NetCat WinHex

Challenges Encryption Use as Evidence Evolving Technology

Application

Step 1: Observation

Observation Actual Observation – On the shop floor Historic – Statistics – Distribution Diagrams – System Architecture

Observation Develop the Equation BASIS FOR ENTIRE MODEL

Step Two Develop the Model

Models Network Models – Processes – Data flow – Queues

Models Monte Carlo – Deterministic – Largely Random

Model Objective – Gain Knowledge – Matching real and simulated – Now Let’s break it

Step 3 Analyze and Fix

Analysis Multiple Iterations Compare Expected and Actual Results Compare Actual and Historic Results

Benefits to UNIWO Security of IT systems – Pre and post simulation will allow us to identify threats earlier Stability – Probability of having an unexpected system shutdown is decreased significantly Simulation added to computer forensics will improve chances for catching cybercriminals by identifying their patterns