Presentation is loading. Please wait.

Presentation is loading. Please wait.

1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM.

Similar presentations


Presentation on theme: "1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM."— Presentation transcript:

1 1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM

2  MIT graduate with 30 years of experience in IT  Senior Information Security Consultant for Security Management Partners.  PCI QSA  Forensic investigations with IT, HR and Legal departments for various regulated industries such as banking, healthcare and pharmaceutical. 2

3  ACH fraud  Embezzlement  Harassment  Civil case 3

4 1. Encase Forensic Antivirus software 3. Malwarebytes 4. Excel 5. Volatility 6. HBGary Responder CE 7. Mandiant Redline 8. Knowledge of Windows technical details 4

5  Funds moved electronically from business online banking account  Investigate—initial information gathering from the financial institution and the business customer  Acquire media using chain of custody protocol  Forensic analysis—acquire forensically and run analysis 5

6 Entry Date Entry Full Path Entry Type 08/24/10 11:29:11AMC\WINDOWS\Prefetch\WINZIP32.EXE-2F3C90C9.pfCreated Date 08/24/10 11:29:11AMC\WINDOWS\Prefetch\WINZIP32.EXE-2F3C90C9.pfWritten Date 08/24/10 11:29:11AMC\WINDOWS\Prefetch\WINZIP32.EXE-2F3C90C9.pfModified Date 08/24/10 11:29:16AM C\Documents and Settings Date 800 entries for cookies on the system 08/24/10 11:29:21AM C\Documents and Settings Date 6

7  Funds stolen from business  Investigate—initial information gathering from the business  Acquire media using chain of custody protocol  Forensic analysis—acquire forensically and run analysis 7

8  Changing the extension on a file.  Embedding data in a graphic file or scanning a document so that it becomes a graphic file. This would prevent the text within the document from being identified during a keyword search.  Using a compression utility to compress multiple files or documents into a single compound file (i.e..zip file).  Encryption: using a utility such as TrueCrypt to create a hidden\encrypted volume on the hard drive. 8

9  Intellectual property stolen from business  Investigate—initial information gathering from the business  Acquire media using chain of custody protocol  Forensic analysis—acquire forensically and run analysis 9

10  Shortcuts contain a volume serial number  In order for these Link files to have been created on the hard drive, the USB drive had to have been plugged into the computer containing the hard drive on which the Link files were located and a file from the USB drive had to have been accessed from that computer. 10

11  Employee reports harassment to HR  Investigate—initial information gathering from the business  Acquire media using chain of custody protocol  Forensic analysis—acquire forensically and run analysis 11

12  System Restore uses a feature called system protection to regularly create and save restore points on your computer. These restore points contain information about registry settings and other system information that Windows uses.  People trying to hide their activities may not realize that information has been saved by System Restore 12

13  A/V definitions change daily, full scans should be run at least weekly  Investigate what your a/v console reports  Investigate unusual events:  Account lockouts  Use a minimum necessary approach throughout your environment:  Block outbound traffic  Only give access to social media to those with a business need (marketing)  Block webmail access 13

14  Train your users  Call the help desk  Be careful with attachments 14


Download ppt "1 P RESENTED BY D AVE M AUPIN S ECURITY M ANAGEMENT P ARTNERS W ALTHAM, MA WWW. SMPONE. COM."

Similar presentations


Ads by Google