1. Chapter Extension 24 Computer Crime and Forensics © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke

2. CE24-2 Study Questions What are the three types of computer crime? What is the extent of computer crime? How can computer crime be prevented? What laws pertain to governmental search of computers? What is computer forensics? How should organizations respond to a suspected computer crime?

3. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE24-3 What Are the Three Types of Computer Crime? Crimes committed using computer – Examples: theft of financial assets, phishing, child pornography Crimes committed against a computer – Examples: viruses, unauthorized access, theft of proprietary data, theft of computer equipment Crimes where computer was used to store data that can be used as evidence – Examples: address books, e-mails. Databases of criminal activity

4. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE24-4 Computer Crimes Criminal act – Crimes already occurred Differs from terrorism, which is not covered under criminal law – Future criminal acts Different rules of evidence Search and seizure boundaries not the same

5. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE24-5 What Is the Extent of Computer Crime? No national census Relies on surveys – FBI/CSI survey – Many organizations don’t report crimes Top reported losses – Viruses, unauthorized access, laptop theft, theft of proprietary data

6. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE24-6 Computer Crime, 2005 FBI/CSI Survey Figure CE 24-2

7. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE24-7 How Can Computer Crime Be Prevented? Develop security plan Manage security risk – List assets – Determine threats against assets – Develop safeguards May be uneconomic to create safeguards Management may accept risk of loss

8. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE24-8 What Laws Pertain to Governmental Search of Computers? Fourth Amendment protects against illegal search and seizure – Limits governmental actions – Restricts employers – Expectation of privacy – Can consent to warrantless search First Amendment right to free speech – Material on Web sites protected

9. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE24-9 What Is Computer Forensics? Forensics – Use of science to obtain data for use by legal system Computer forensics – Identification, collection, examination, and preservation of digitally recorded data – Easy to damage data during process – Deleted data not really gone System de-allocates space on disk Data still resides there until over-written Software tools can read de-allocated space

10. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE24-10 Computer Forensics, continued – Data may be hidden in many locations on network Files can be disguised by name and type – Steganography Messages hid by encoding them in files Hid in inessential overhead data Programs for finding steganography not effective

11. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE24-11 Organizational Responses to a Suspected Computer Crime Treat like any other security incident – Develop incident response plan – Actions should depend upon nature of crime Contain, eradicate, and recover Preserve evidence for prosecution May have to allow attack to continue to gather evidence – Balance liability against need to know full nature of attack

12. © 2008 Pearson Prentice Hall, Experiencing MIS, David Kroenke CE24-12 Active Review What are the three types of computer crime? What is the extent of computer crime? How can computer crime be prevented? What laws pertain to governmental search of computers? What is computer forensics? How should organizations respond to a suspected computer crime?