Evgeniou, Panagiotis

2017-03-25T01:00:19Z

https://repository.ihu.edu.gr//xmlui/handle/11544/15203

Cybercrime Investigation and Digital Forensics with open source tools

Computer security

Forensic sciences

Computer crimes--Investigation

Cyberterrorism

free

[1] Campbell A. (2010). by Command of Her Majesty. “ Cybercrime strategy” . UK Government. Retrieved January 10, 2016, from: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/228826/7842.pdf [2] Rogers M. (2003). The Psychology of Cyber terrorism , in Terrorists . Victims and Society: Psychological Perspectives on Terrorism and its Consequences (ed A. Silke). John Wiley & Sons Ltd, Chichester, UK. doi: 10.1002/9780470713600.ch4 [3] Andrew M. Colarik (2006). Cyber Terrorism: Poli tical and Economic Implications . Ideal Group Inc (IGI) [4] Borum, R. (n.d.). Psychology of Terrorism . Retrieved August 12 , 2016, from https://www.ncjrs.gov/pdffiles1/nij/grants/208551.pdf [5] Roussev V., Wang L., Richard G. and Marziale L., (2009). A cloud computing platform for large - scale forensic comp uting, in Advances in Digital Forensics V , G. Peterson and S. Shenoi (Eds.), Springer, Heidelberg, Germany, pp. 201 – 214 [6] Steadman, I. (2013) “Largest cyber - attack ever” is happening right now, threatens rest of web . Wired. Retrieved October 3, 2016, fr om: http://www.wired.co.uk/news/archive/2013 - 03/27/biggest - cyber - attack - spamhaus [7] NATO Science for Peace and Security Series E. (2008) Human and Societal Dynami cs - Vol. 34 , Centre of Excellence Defence Against Terrorism, Responses to Cyber Terrorism, IOS Press, Political Science [8] Singer W. P. ( 2012 ) . The Cyber Terror Bogeyman . Brookings. Retrieved October 3, 2016, from: http://www.brookings.edu/research/articles/2012/11/cyber - terror - singer [9] Wilhelm, Douglas (2010) . Professional Penetration Testing . Syngress Press. p. 503. [10] Gartner. ( 2015). Gartner Says Worldwide Clou d Infrastructure - as - a - Service Spending to Grow 32.8 Percent in 2015 . Retrieved October 4, 2016, from http://www.gartner.com/newsroom/id/3055225 [11] Moore, Robert (2005). Cybercrime: Investigating High Technology Computer Crime . Matthew Bender & Company. p. 258 [12] Moore, Robert (2006). Cybercrime: Investigating High - Technology Computer Crime (1st ed.) . Cincinnati, Ohio: Anderson Publishing [13] Prof. Sokratis Katsikas (2016). Information Assurance: Information Security. Center for Cyber and Information Security . Retrieved October 3, 2016, from https://elearn.ihu.edu.gr/course/view.php?id=1125 79 | P a g e P a n a g i o t i s E v g e n i o u [14] Poona S. A. (2014 ). Cyberc rime : Challenges and its Classification, Bikaner, India . Retrieved August 24, 2016 from: http://www.coe.int/t/dghl /cooperation/economiccrime/Source/Cybercrime/TCY/2015/T - CY(2015)10_CEG% 20challenges% 20rep_sum_v8.pdf [15] Cohen A. (2010), Cyber terrorism : Are We Legally Ready . J. Int'l Bus. & L. 9 (2010): Chapter 1 [16] Papalaz. I. (2015), “ Cyber terrorism ”. Essay. Univ ersity of Portsmouth [17] Tehrani, Mosl emzadeh P., Manap N. A., Taji H . (2013). Cyber terrorism challenges: The need for a global response to a multi - jurisdictional crime . Computer L aw & Security Review 29.3 p. 207 - 215 [18] Ruan, K., Carthy, J., Kechadi, T., & Crosbie, M. (2011). Cloud Forensics. Advances in Digital Forensics VII . Retrieved September 22, 2016, from : http://c loudforensicsresearch.org/publication/Cloud_Forensics_An_Overview_7th_IFIP.pdf [19] National Institute of Standar ds and Technology. (2006 ). Guide to Integrating Forensic Techniques into Incident Response . Gaithersburg. Retrieved September 22, 2016, from : http://csrc.nist.gov/publications/nistpubs/800 - 86/SP800 - 86.pdf [20] Peter son G., Shenli S., (2011 ). Advances in Digital Forensics VII: 7th IFIP WG 11.9 International Conference on Digital Forensics , Orlando, FL, USA, January 31 - February 2, 2011, Revised Selected Papers, Springer, Science & Business Media, pp.36 [21] Wold U. ( 2009). Digital Communities. Cybercrime : Law Enforcement Must Keep Pace With Tech - Savvy Criminals . Retr ieved June 4, 2016 from : http://www.govtech.com/dc/articles/ Cybercrime - Law - Enforcement - Must - Keep - Pace.html [22] Gabriel, Weimann (2004). Cyber terrorism , How Real Is the Threat? United States Institute For Peace [23] Nykodym N., Taylor R., Vilela J. (2005). Criminal Profiling and Insider cybercrime , Digital Investigation, Vol. 2 Issue 4, pp. 261 - 267 [24] Kassner, M. (2014) New Ponemon report shows cybercrime i s on the rise . TechRepublic. 3 November 2014. Retrieved September 28, 2016, from: http://www.techrepublic.com/article/new - ponemon - report - shows - cybercrime - is - on - the - rise [25] Gordon S, Ford R. (2002). Cyber terrorism ? Computers & Security. Vol 21 , No 7, 2002 [26] Leroux O. (2004). Legal Admissibility of Electronic Evidence. International Review of Law Computers and Technology. Vol. 18, No 2 , pp. 193 - 220 80 | P a g e P a n a g i o t i s E v g e n i o u [2 7] Rowlingson R., ( 2004). A ten Step Process for Forensic Readiness. International Journal of Digital Evidence. Volume 2, Issue 3 . Retrieved October 2, 2016, from: http://www.utica.edu/ac ademic/institutes/ecii/ijde/ [28] Insa F. (2007). The admissibility of electronic evidence in court (A.E.E.C.): Fighting against high - tech crime results of a European study. Journal of Digital Forensic Practice , pp. 285 - 289 [29] Sommer P. (1998). “Digita l Footprints: Assessing Computer Evidence”, Criminal Law Review - Special Edition . pp. 61 - 78 [30] RAND Europe. (2002). Handbook of Legislative Procedures of Computer and Network Misuse in EU Countries – Study for the European Commission . Directorate - General Information Society [31] Council of Europe (CoE). (2001). Explanatory Report to the Convention on Cybercrime . Retrieved August 28, 2016, from : https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016800cce5b [32] Mitrakas, A., Zaitch D. (2006 ). Law, Cybercrime and digital forensics: Trailing Digital Suspects , in Kanelis P., Kiountouzis E., Kolokotronis N., Drakoulis M. (Eds), Digital Crime and Forensic Science in Cyber space , London, pp. 267 - 290 [33] Komninos K. (2016 ). Data Protection. Lecture presented on May 23, 2016 at Legal and Ethical Foundations of Privacy and Security unit , at International Hell enic University, in Thermi, Thessaloniki. Retrieved October 5, 2016, from: http://ec.europa.eu/justice/data - protection/files/factsheets/factsheet_ data_protection_en.pdf [34] Commission of the European Communities. (2006). “Green Paper on detection technologies in the work of Law Enforcement” , Customs and other Securit y Authorities - COM, 474 [35] Murugesan S., Bojanova I. (2016) . Encyclopaedia of Cloud Computing . pp. 238 [36] Sieber U., (1998) . Legal Aspects of Computer - Related Crime in the Information Society , COMPRIME Study [37] Downing, R. W. (2005). Shoring Up the Weakest Link: What Lawmakers Around the World Need to Consider in Developing Co mprehensive Laws to Combat Cybercrime . Columbia Journal of Transnational Law, 43, pp. 741 - 762 [38] Brenner S. W., Koops B. - J. (2004). Approaches to cybercrime jurisdiction. Journal of High Technology Crime , 15(1), pp. 1 - 46 [39] Broadhu rst R. G. (2006). Developments in the global law enforcement of cybercrime . Policing: An International Journal of Police Strategies and Management, 29(3), pp. 408 - 433 81 | P a g e P a n a g i o t i s E v g e n i o u [4 0] Roth B. R. (2005 ). State sovereignty, international legality, and moral disagreement. Paper presented at the Annual Meeting of the American Political Science Association . Retrieved September 28, 2016, from : http://www.ihrr.net/files/2006ss% 20/State - Sovereignty - Int - Legality - Morality - Roth - 2005.pdf [41] Bromby M. (2006). Security against Crime: Technologies for Detecting and Preventing Crime. International Review of Law Computers & Technology , 20, pp. 1 - 5 [42] Sirohi M. N. (2015). Transformational D imensions of Cybercrime . Delhi. Alpha Editions [43] Stimson E. S. (1936). Conflict of Criminal Laws . Chicago: The Foundation Press. Retrieved on August 29, 2016, from http://www.constitu tion.org/cmt/stimson/con_crim.htm [44] Bermay F. P., & Godlove, N. (2012). Understanding 21st century cybercrime from the ‘common’ victim’ . Criminal Justice Matters, 89(1), pp. 4 - 5 [45] Gercke M. (2012). Hard and soft law options in response to cybercrim e - How to weave a more effective net of global responses . Computer Law Review International, 3, pp. 78 - 87 [46] International Telecommunications Union (2012). Understanding Cybercrime – Phenomena, Challenges, Legal Response, 2nd edition . Retrieved August 29, 2016, from : http://www.itu.int/ITU - D/cyb/cybersecurity/docs/Cybercrime% 20legislation% 20EV6.pdf [47] Birk D. ( 2011) . Technical challenges of forensic investigations in cloud computing environments [48] Dykstra J., Sherman A. (2011) Understanding issues in cloud forensics: Two hypothetical case studies , Journal of Network Forensics , vol. b, no. 3, pp. 19 – 31 [49] Guo H., Jin B., Shang T. (2012). Forensi c investigations in cloud environments , in Computer Science and Inf ormation Processing (CSIP), International Conference on IEEE, pp. 248 – 251 [50] Wolthusen S. (2009). Overcast: Forensic discovery in cloud environments , in proceedings of the Fifth Internat ional Conference on IT Security Incident Management an d IT Forensics (IMF). IEEE , pp. 3 – 9 [51] Reilly D., Wren C., Berry T. (2011). Cloud computing: Pros and cons for computer forensic investigations , International Journal Multimedia and Image Processing ( IJ MIP), vol. 1, no. 1, pp. 26 – 34 [52] Ludwig M. D., Slusky , Parviz Partow - Navid. (2012). Cloud computing and computer forensics for business applications , Journal of Techno logy Research, vol. 3 [53] Zafarullah, Anwar F., Anwar Z. (2011). Digital forensic s for eucalyptus , in Frontiers of Information Technology (FIT). IEEE, pp. 110 – 116 [54] Biggs S., Vidalis S.. (2009). Cloud computing: The impact on digital forensic investigations , in In proceedings of the International Conference for Internet Technology and Secured Transactions, ICITST. IEEE, pp. 1 – 6 82 | P a g e P a n a g i o t i s E v g e n i o u [55] Birk D., Wegener C. (2011). Technical issues of forensic investigations in cloud computing environments , Systematic Approaches to Di gital Forensic Engineering [56] Borum R. (n.d.). Psychology of Terrorism . Retrieved September 22, 2016, from https://www.ncjrs.gov/pdffiles1/nij/grants/208551.pdf [57] Fitch C., ( 2003). Crime and Punishment: The Psychology of Hacking in the New Mil lennium . Retrieved August 28, 2016, from https://www.giac.org/paper/gsec/3560/crime - punishment - psychology - hacking - millennium/105795 [58] We Are 4n6. (2016). Extracting Data from Damaged Hard Drives. Retrieved October 6, 2016, from: http://www.weare4n6.com/extracting - data - from - damaged - hard - drives/ [59] Reiber L. (Oxygen Forensics Inc.), ForensicFocu sVideos's channel. (2016 ). Deep Diving for Forensic Gold - Applications and Deleted Data . [Video File]. Retrieved Oct ober 10, 2016, from: https://www.youtube.com/watch ?v=_InhDA6FwFk [60] Samarati M. ( 2016). Americans: concerned about cyber - attacks but failing to take basic precautions. IT Governance. Protect – Comply – Thrive – IT Governance USA Blog. Retrieved Oct ober 11, 2016 from: http://www.itgovernanceusa.com/blog/americans - concerned - about - cyber - attacks - but - failing - to - take - basic - precautions/?ut m_source=social&utm_medium=linkedingroup [61] Battison H. ( 2016). Concern about Cyber Threats on the Rise, Yet Many Neglect Protective Measures. Transunion. Retrieved Oct ober 11, 2016, from: http://newsroom.transunion.com/concern - about - cyber - threats - on - the - rise - yet - many - neglect - protective - measures/ [62] Homeland Secu rity. ( 2016). National Cybersecurity Awareness Month. Official webs ite of the Department of Homeland Security. Retrieved Oct ober 11, 2016, from: https://www.dhs.gov/national - cybersecurity - awareness - month [63] National Cybersecurity and Communicati ons Integration Center. ( 2014). Combating the Insider Threat. Retrieved Oct ober 13, 2016, from: https://www.us - cert.gov/sites/defau lt/files/publications/Combating% 20the% 20Insider% 20Threat_0.pdf [64] Gutmann P. ( 1996). Secure Deletion of Data from Magnetic and Solid - State Memory. Department of Computer Science. University of Auckland. Sixth USENIX Security Symposium. pp. 77 - 90 [65] Z hand Y., Monrose F., Reiter M. K. (2010). The Security of Modern Password Expiration: An Algorithmic Framework and Empirical Analysis. University of North Carolina at Chapel Hill, NC. pp 176 - 186 [66] PhotoRec [Computer Software]. (2016). Retrieved Septemb er 29, 2016, from: http://www.cgsecurity.org/wiki/PhotoRec [67] Autopsy [Computer Software]. (2016). Retrieved Jul y 20, 2016, from: http://www.sleuth kit.org/autopsy/ 83 | P a g e P a n a g i o t i s E v g e n i o u [68] Office o f the Press Secretary. ( 2016). FACT SHEET: Launch of the "Lock Down Your Login" Public Awareness Campaign . The White House. Retrieved Oct ober 3, 2016, from: https://www.whitehouse.gov/the - press - office/2016/09/28/fact - sheet - launch - lock - down - your - login - public - awareness - campaign [69] Office of the Press Secretary. ( 2016). FACT SHEET: Cybersecuri ty National Action Plan. The White House. Retrieved Oct ober 3, 2016, from: https://www.whitehouse.gov/the - press - office/2016/02/09/fact - shee t - cybersecurity - national - action - plan [ 70] StaySafeOnline. ( 2016). National Cybersecurity Alliance Survey Reveals the Complex Digital Lives of American Teens and Parents . National Cybersecurity Alliance. Retrieved October 3, 2016, from: https://staysafeonline.org/about - us/news/national - cybersecurity - alliance - survey - reveals - the - complex - digital - lives - of - american - teens - and - parents [71] Bennett C. ( 2016). How to Format Hard Drive Using Command Prompt (Tutorial). Tom’s Hardware. The Authority on Tech. Retrieved Oct ober 8, 2016, from: http://www.tomshardware.co.uk/faq/id - 3016317/format - hard - drive - command - prompt - tutorial.html [72] Zimmerman C. (2014). MITRE: Ten Strategies of World - Class Cybersecurit y Operations Center. Retrieved Oct ober 14, 2016, from: https://www.mitre.org/sites/default/files/publications/pr - 13 - 1028 - mitre - 10 - str ategies - cyber - ops - center.pdf [73] Torgersen, D. (2016). Cybersecurity: How to Win the Big Game. DarkReading. Retrieved Oct ober 20, 2016, from: http://event.on24.com/eventRegistration/EventLobbyServlet?target=lobby.jsp&eventid=1274393&sessionid=1&key=220 834225CD4814CA56C88D223FE649C&eventuserid=152750903 [74] Rosenblatt K. ( 2016). Brad Pitt death hoax is actually malware that can destroy phones and computers and expose sensitive information to hackers . Retrieved October 14, 2016, from: http://www.dailymail.co.uk/news/article - 3810733/Brad - Pitt - death - hoax - actually - malware - destroy - phones - computers - expose - sensitive - information - hackers.html [75] Verizon. ( 2014). Data Breach Investigations Report 2013 . Retrieved Oct ober 19, 2016, from: http://www.verizonenterprise.com/resources/reports/rp_data - breachinve stigations - report - 2013_en_xg.pdf [76] R ichet J - L. ( 2015). Extortion on the Internet : the Rise of Crypto - Ransomware . Harvard University. Retrieved Oct ober 19, 2016, from: https://blogs.harvard.edu/jeanlouprichet/files/2015/07/Extortion_on_the_Internet_Rise_of_Crypto_Ransomware.pdf [77] Ponemon Institute. ( 2014). Cost of Data Breach: Global Analysis . Retrieved October 20, 2016, fro m: http://www.ponemon.org/blog/ponemon - institute - releases - 2014 - cost - of - databreach - global - analysis 84 | P a g e P a n a g i o t i s E v g e n i o u [78] Reuters. ( 2014). Your Medical Record Is Worth More to Hackers Than Your Credit Card . Retrieved October 21, 2016, from: http://www.reuters.com/article/2014/09/24/us - cybersecurity - hospitalsidU SKCN0HJ21I20140924 [79] Business In sider. ( 2014) Here’s What Happened To Your Target Data That Was Hacked . Retrieved October 21, 2016, from: http://www.businessinsider.com/heres - what - happened - to - your - target - data - thatwas - hacked - 2014 - 10#ixzz3VPJVjbHI [80] Gilbert, S. B. (2015). Red, Purple and Pink: The Colors of Diffusion on Pinterest. PLoS One , 1 - 20. [81] Symantec Corporation. ( 2010). Cybercrime Report: The Human Impact . Retrieved December 18, 2016, from: https://www.symantec.com/content/en/u s/home_homeoffice/media/pdf/cybercrime_report/Norton_USA - Human% 20Impact - A4_Aug4 - 2.pdf [82] Williams M. J. (1990). Style Toward Clarity and Grace. The University of Chicago Press. Chicago and London [83] Flew T., Suzor N. Liu R. B. (2013). Copyrights and copyfights: copyright law and the digital economy . Inderscience Enterprised Ltd. Retrieved December 18, 2016, from: http://modir3 - 3.ir/article - english/article252.pdf [84] HM Government. (Oc t. 2013). Serious and Organised Crime Strategy . UK Government. Retrieved December 18, 2016, from: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/248645/Serious_and_Organised_Crim e_Strategy.pdf [85] Linden V. E. (2007). Focus on Terrorism, Volume 9 . Nova Science Publishers, Inc. New York [86] RSA FraudAction Research Labs. ( 2011). Anatomy of an attack . RSA. Retrieved December 20, 2016, from: https://blogs.rsa.com/anatomy - of - an - attack/ [87] Rodrigues P. (2015). Next - Generation Cybersecurity for the Future . CSO. Retri eved December 20, 2016, from: http://www.cso.com.au/article/582348/next - generation - cybersecurity - future/ [88] IBM Security. (2015) IBM 2015 Cybersecurity Intellige nce Index - Analysis of cyber - attack and incident data from IBM's worldwide security services operations . IBM. Retrieved December 21, 2016, from: https://www - 01.ibm.com/common/ssi/cgi - bin/ssialias?htmlfid=SEW03073USEN [89] Jajodia, S., Liu, P., Swarup, V., Wang, C. (2010). Cyber Situational Awareness . Springer US [90] RSA. (2016). EMA Research Report: Achieving High - Fidelity Security . Retrieved De cember 21, 2016, from: https://www.rsa.com/content/dam/rsa/PDF/EMA - RSA_HighFidelitySecurity - 0216 - WP.pdf

2017-03-23

5 | P a g e P a n a g i o t i s E v g e n i o u Table of Contents Acknowledgements ................................ ................................ ................................ ................................ ................................ .... 2 Abstract ................................ ................................ ................................ ................................ ................................ ........................ 2 Abbreviations ................................ ................................ ................................ ................................ ................................ .............. 3 Table of Contents ................................ ................................ ................................ ................................ ................................ ........... 5 Aim – Recommendations ................................ ................................ ................................ ................................ ........................ 11 Writing Style ................................ ................................ ................................ ................................ ................................ .............. 11 Method of research ................................ ................................ ................................ ................................ ................................ .. 11 1 Introduction ................................ ................................ ................................ ................................ ................................ ............... 12 1.1 Cybercrime ................................ ................................ ................................ ................................ ................................ .......... 13 1.2 Cyber terrorism ................................ ................................ ................................ ................................ ................................ ... 15 1.2.1 Definition of Cyber terrorism ................................ ................................ ................................ ................................ ...... 15 1.2.2 Types of Cyber terrorism ................................ ................................ ................................ ................................ ............ 16 1.3 Digital Forensics ................................ ................................ ................................ ................................ ................................ . 17 1.4 Cl oud Forensics ................................ ................................ ................................ ................................ ................................ .. 17 1.4.1 When is digital forensics in the cloud required ................................ ................................ ................................ ....... 17 2 Literature Review ................................ ................................ ................................ ................................ ................................ ....... 18 2.1 Methods of Digital Forensic Investigation ................................ ................................ ................................ ....................... 18 2.1.1 NIST Method ................................ ................................ ................................ ................................ ................................ 18 7 | P a g e P a n a g i o t i s E v g e n i o u 3 Contribution ................................ ................................ ................................ ................................ ................................ ............... 40 3.1 Digital Forensics Difficulties ................................ ................................ ................................ ................................ .............. 40 3.1.1 Physical Inaccessibility ................................ ................................ ................................ ................................ ................ 40 3.1.2 Architecture challenges ................................ ................................ ................................ ................................ .............. 40 3.1.3 Analysis challenges ................................ ................................ ................................ ................................ ..................... 40 3.1.4 Crime Scene Reconstruction ................................ ................................ ................................ ................................ ...... 40 3.1.5 Anti - forensics ................................ ................................ ................................ ................................ ................................ 40 3.1.6 In cident first responders ................................ ................................ ................................ ................................ ............. 40 3.1.7 Role Management ................................ ................................ ................................ ................................ ...................... 40 3.2 A compromised account ................................ ................................ ................................ ................................ ................... 40 3.3 Legal Challenges of cybercrime investigation ................................ ................................ ................................ ................ 41 3.3.1 Data Protection ................................ ................................ ................................ ................................ ............................ 41 3.3.2 The “right to be forgotten” ................................ ................................ ................................ ................................ ........ 41 3.3.3 Weaknesses in substantive criminal laws ................................ ................................ ................................ ................ 42 3.3.4 Law Enforcement Resources ................................ ................................ ................................ ................................ ...... 42 3.4 Challenges posed by Cyber terrorism ................................ ................................ ................................ ............................. 43 3.5 Lack of following basic cybersecurity precautions ................................ ................................ ................................ ......... 43 3.5.1 Cybersecurity starts at home ................................ ................................ ................................ ................................ ..... 44 3.5.2 Advanced Threats and Human Nature ................................ ................................ ................................ .................... 44 3.5.3 It’s National Cybersecurity Awareness Month! (October 2016) ................................ ................................ .............. 44 3.5.4 Cybercrime Motivators ................................ ................................ ................................ ................................ ................ 45 3.5.4 The value of data ................................ ................................ ................................ ................................ ......................... 45 9 | P a g e P a n a g i o t i s E v g e n i o u 4.2.1 Scenario (real but let’s add something for investigation) ................................ ................................ ....................... 59 4.3 Digital Forensics Process ................................ ................................ ................................ ................................ ................... 61 4.3.1 Damaged Hard Disk Drives ................................ ................................ ................................ ................................ ....... 61 4.3.2 Recovering Hard Disk Deleted Data ................................ ................................ ................................ ......................... 61 5 Conclusions ................................ ................................ ................................ ................................ ................................ ................ 65 5.1 NCSA/Microsoft Survey ................................ ................................ ................................ ................................ ...................... 66 5.2 Proposed Solutions ................................ ................................ ................................ ................................ ............................ 66 5.2.1 Client Side Identification ................................ ................................ ................................ ................................ ............. 67 5.2.2 Integrity and Stability – Privacy and Multi - Tenancy ................................ ................................ ................................ 67 5.2.3 Time Synchronization – Reconstruction ................................ ................................ ................................ ................... 67 5.2.4 Internal Staffing ................................ ................................ ................................ ................................ ........................... 67 5.2.5 Chain of Custody ................................ ................................ ................................ ................................ ......................... 68 5.2.6 Volume of Data ................................ ................................ ................................ ................................ ........................... 68 5.2.7 Complexity of Testimony ................................ ................................ ................................ ................................ ............ 68 5.2.8 Documentation ................................ ................................ ................................ ................................ ............................ 68 5.2.12 Compliance Issues ................................ ................................ ................................ ................................ .................... 68 5.2.13 Solutions Table ................................ ................................ ................................ ................................ .......................... 69 5.3 Le gal Challenges ................................ ................................ ................................ ................................ ................................ 69 5.4 Malware Incident Prevention Strategy ................................ ................................ ................................ ............................. 70 5.5 How predictive analytics can discover a data breach before it happens ................................ ................................ ... 70 5.6 Lack of experience and tools ................................ ................................ ................................ ................................ ............ 72 5.6.1 File Recovery software - their “smart way” of gaining money/license/subscribers ................................ ............ 72 10 | P a g e P a n a g i o t i s E v g e n i o u 5.7 Frequent Password Changes Is a Bad Security Idea ................................ ................................ ................................ ..... 72 5.8 Insider Thre at Solution ................................ ................................ ................................ ................................ ...................... 73 5.9 The Engine to Power Next - Generation Cybersecurity – Data Science ................................ ................................ ......... 74 5.10 Best method: “Training and Knowledge” ................................ ................................ ................................ ..................... 74 5.10.1 Response Plan ................................ ................................ ................................ ................................ ........................... 75 5.10.2 A ddressing the people problem ................................ ................................ ................................ .............................. 75 5.10.3 Analyzing cybersecurity companies researches, software, scripts ................................ ................................ ...... 75 5.11 Future (2017) predictions ................................ ................................ ................................ ................................ ................ 76 6 Key Findings ................................ ................................ ................................ ................................ ................................ ............... 77 6.1 Digital Forensics ................................ ................................ ................................ ................................ ................................ . 77 6.2 Cybercrime Investigation ................................ ................................ ................................ ................................ ................... 77 6.3 Protecting an Organization ................................ ................................ ................................ ................................ ............... 77 6.4 Protecting people ................................ ................................ ................................ ................................ ............................... 77 7 Reference ................................ ................................ ................................ ................................ ................................ ................... 78 8 Appendices ................................ ................................ ................................ ................................ ................................ ................. 86 Screenshots from the real scenario at section 4.5 ................................ ................................ ................................ ............... 86 Screenshot of the software, scripts and O/S used for digital forensics ................................ ................................ .............. 88

Papathanasiou, Anastasios

ihu