Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #6 Forensics Services September 10, 2007

Outline l Cyber crime l Cyber detective l Risk Management l Investigative services l Process improvement l Conclusion l Links l Appendix: Malicious Code Detection

Review of Lecture #5 l Lectures 5 - Types of Computer Forensics Systems - Objective: Identify issues in corporate planning for computer forensics l Tools for Digital Forensics l Assignment #1 l Lab Tour

Lecture 5: Types of Computer Forensics Systems l Internet Security Systems l Intrusion Detection Systems l Firewall Security Systems l Storage Area Network Security Systems l Network disaster recovery systems l Public key infrastructure systems l Wireless network security systems l Satellite encryption security systems l Instant Messaging Security Systems l Net privacy systems l Identity management security systems l Identify theft prevention systems l Biometric security systems l Homeland security systems

Cyber Crime l Financial Fraud l Sabotage of Data or Networks l Theft of Proprietary Information l System Penetration from the outside and denial of service l Unauthorized access by insiders and employee misuse of Internet access privileges: Insider threat l Malicious code (e.g., Virus)

Cyber Detective l Forensics investigators - detect the extent f security breach, - recover lost data, - determine how an intruder got past the security mechanisms, - and possibly identify the culprit l Legal issues - Admissibility of digital evidence in court - Laws lag technology - Theft: A person must permanently deprive the victim of property: does this apply to cyber theft?

Risk Management l Risk management - is the human activity which integrates recognition of risk, risk assessment, developing strategies to manage it, and mitigation of risk using managerial resources.risk risk assessmentstrategies - The strategies include transferring the risk to another party, avoiding the risk, reducing the negative effect of the risk, and accepting some or all of the consequences of a particular risk. - l Risk management for Computer Forensics - Effective IT and staff policies - Use of state of the art Vendor tools - Effective procedures

Forensic Services l Forensics Incident Response l Evidence Collection l Forensic Analysis l Expert witness l Forensic litigation and insurance claims support l Training l Process improvement

Investigative services examples l Intrusion detection service - Installing technical safeguards to spot network intruders or detect denial of service attacks at e-commerce servers l Digital evidence collection - Identify all devices that may contain evidence - Quarantine all in-house computers - Court orders to preserver and collect evidence

Process Improvement: Tools l Dig –x/nslookup l Whois l Ping l Traceroute l Finger l Anonymous surfing l USENET l Need to integrate the processes

Conclusion l Part I has provided an overview of computer forensics and discussed technologies, systems and services l There are two major aspects: one is detect that a problem has occurred and the other is finding out who did it l Technology and legal aspects: both work together l Should a corporation outsource the forensics services or carry it out in-house l Evidence collected must be stored in a secure place – security techniques include encryption l Must manage and mitigate risks

Links l l l Dallas, TX l l l Austin, TX l forensics/ forensics/ l l