1. 1 Advanced Cyber Security Forensics Training for Law Enforcement Building Advanced Forensics & Digital Evidence Human Resource in the Law Enforcement sector

2. 2 WHY CYBER FORENSICS AND DIGITAL EVIDENCE READINESS? Prepared by: AMNET CYBERDEFENCE NETRON (ACDN) Dept. of Cyber Forensics & Information Security Approved by: Cybersecurity Control and Information Bureau (2CIB)

3. 3 AMNET OVERVIEW Amnet Cyberdefence Netron (ACDN) has positioned itself and build standards that will support any institution to be resilient from cyberattacks: Helping both public and private sectors build a resilient human capital that will be able to Prepare, Prevent and Protect (P3) + Detect and Deter (D2) = Recover and Reporting (2R). Formula: P3+D2=2R Support both public and private sector build advanced Cyber Security Operation systems that will proactively give real time attack detections with consistent upgrade. ACDN will continue to be a vital resource to both public and private sector in Africa. We will not be just a Cyber security consulting and operations firm but cyber security partner who will manage and respond 24/7 the challenges that might occur to your technical teams ACDN CYBERSECURITY CAPABILITY CENTER

4. Cont’ 360 0 Cybersecurity Investigation & Intelligence Training: With the advent of emerging technology and evolution of Cloud, IoT and AI, law enforcing organizations need to match their human resource inline with technology and innovation to support investigations, crime and evidence security and prosecution. Cyber security is one of the highest impediment to successful prosecution thereby the need advanced experts within the institutions to support Cyber security focused, Intelligence, Investigation and Prosecution.

5. 5 Cybersecurity Forensic & Digital Evidence “ Cybersecurity Forensics, is an advanced investigation and analysis methodology used to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law. The process requires advanced tools and secure derived and proven methods toward the preservation, collection, validation, identification, analysis, interpretation, documentation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal, or helping to anticipate unauthorized actions shown to be disruptive to planned operations.”

6. 6 Users of Cybersecurity Forensic and Digital Evidence

7. 7 Includes : Networks (Network Forensics) Small Scale Digital Devices Storage Media (Computer forensics) Code Analysis Cyber Forensics

8. 8 The cyber forensics is scientific examination and analysis of digital evidence in such a way that the information can be presented as evidence in a court of law with minimal errors.

9. 9 Cyber Forensic Activities Cyber forensics activities commonly include: the secure collection of computer data the identification of suspect data the examination of suspect data to determine details such as origin and content the presentation of computer-based information to courts of law the application of a country's laws to computer practice.

10. 10 The 3 As The basic methodology consists of the 3 As: –Acquire the evidence without altering or damaging the original –Authenticate the image –Analyze the data without modifying it

11. 11 Context of Cyber Forensics Homeland Security Information Security Corporate Espionage White Collar Crime Child Pornography Traditional Crime Incident Response Employee Monitoring Privacy Issues ???? Digital Forensics Cyber Forensics

12. 12 Forensic Principles Digital/ Electronic evidence is extremely volatile! Once the evidence is contaminated it cannot be de- contaminated! The courts acceptance is based on the best evidence principle With computer data, printouts or other output readable by sight, and bit stream copies adhere to this principle. Chain of Custody is crucial

13. 13 Cyber Forensic Principles The 6 Principles are: 1. When dealing with digital evidence, all of the general forensic and procedural principles must be applied. 2. Upon seizing digital evidence, actions taken should not change that evidence. 3. When it is necessary for a person to access original digital evidence, that person should be trained for the purpose. 4. All activity relating to the seizure, access, storage or transfer of digital evidence must be fully documented, preserved and available for review. 5. An Individual is responsible for all actions taken with respect to digital evidence whilst the digital evidence is in their possession. 6. Any agency, which is responsible for seizing, accessing, storing or transferring digital evidence is responsible for compliance with these principles.

14. Our Global Training Partners

15. Training Packages LEVELLocalInternationalDuration of Training For Executives86,000 per person195,000 per person1 WK (5 days) For Intermediary120,000 per person210,000 per person2 WKs (10 days) For Advanced Professionals148,000 per person245,000 per person2 WKs (10 days) Specialized Experts169,000 per person256,000 Per person3 WKs (15 days) Local and International

16. Contact Information Mr. Haron Oichoe, Executive Director executiveoffice@amnetafrica.net http://www.amnetafrica.net 16