1. Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #6 Forensics Services September 10, 2007

2. Outline l Cyber crime l Cyber detective l Risk Management l Investigative services l Process improvement l Conclusion l Links l Appendix: Malicious Code Detection

3. Review of Lecture #5 l Lectures 5 - Types of Computer Forensics Systems - Objective: Identify issues in corporate planning for computer forensics l Tools for Digital Forensics l Assignment #1 l Lab Tour

4. Lecture 5: Types of Computer Forensics Systems l Internet Security Systems l Intrusion Detection Systems l Firewall Security Systems l Storage Area Network Security Systems l Network disaster recovery systems l Public key infrastructure systems l Wireless network security systems l Satellite encryption security systems l Instant Messaging Security Systems l Net privacy systems l Identity management security systems l Identify theft prevention systems l Biometric security systems l Homeland security systems

5. Cyber Crime l Financial Fraud l Sabotage of Data or Networks l Theft of Proprietary Information l System Penetration from the outside and denial of service l Unauthorized access by insiders and employee misuse of Internet access privileges: Insider threat l Malicious code (e.g., Virus)

6. Cyber Detective l Forensics investigators - detect the extent f security breach, - recover lost data, - determine how an intruder got past the security mechanisms, - and possibly identify the culprit l Legal issues - Admissibility of digital evidence in court - Laws lag technology - Theft: A person must permanently deprive the victim of property: does this apply to cyber theft?

7. Risk Management l Risk management - is the human activity which integrates recognition of risk, risk assessment, developing strategies to manage it, and mitigation of risk using managerial resources.risk risk assessmentstrategies - The strategies include transferring the risk to another party, avoiding the risk, reducing the negative effect of the risk, and accepting some or all of the consequences of a particular risk. - http://en.wikipedia.org/wiki/Risk_management l Risk management for Computer Forensics - Effective IT and staff policies - Use of state of the art Vendor tools - Effective procedures

8. Forensic Services l Forensics Incident Response l Evidence Collection l Forensic Analysis l Expert witness l Forensic litigation and insurance claims support l Training l Process improvement

9. Investigative services examples l Intrusion detection service - Installing technical safeguards to spot network intruders or detect denial of service attacks at e-commerce servers l Digital evidence collection - Identify all devices that may contain evidence - Quarantine all in-house computers - Court orders to preserver and collect evidence

10. Process Improvement: Tools l Dig –x/nslookup l Whois l Ping l Traceroute l Finger l Anonymous surfing l USENET l Need to integrate the processes

11. Conclusion l Part I has provided an overview of computer forensics and discussed technologies, systems and services l There are two major aspects: one is detect that a problem has occurred and the other is finding out who did it l Technology and legal aspects: both work together l Should a corporation outsource the forensics services or carry it out in-house l Evidence collected must be stored in a secure place – security techniques include encryption l Must manage and mitigate risks

12. Links l http://www.compforensics.com/ http://www.compforensics.com/ l http://www.computer-forensic.com/faqs.html http://www.computer-forensic.com/faqs.html l http://www.cfsiusa.com/ http://www.cfsiusa.com/ - Dallas, TX l http://www.evestigate.com/ http://www.evestigate.com/ l http://www.digitaldataforensics.com/ http://www.digitaldataforensics.com/ l http://www.databankservices.com/ http://www.databankservices.com/ - Austin, TX l http://www.vogon-international.com/computer- forensics/ http://www.vogon-international.com/computer- forensics/ l http://www.vogon.co.uk/ http://www.vogon.co.uk/ l http://www.forensiccomputerservice.com/ http://www.forensiccomputerservice.com/