XYZ Company
Tasking
The plan for processing the potential crime/incident scene depends upon maintaining the integrity of the scene as well as the integrity of the data. That means the first step is to prevent the scene from contamination. Preparing for the search is an important step, therefore, in this process.
The team should have the legal authority to proceed with the seizure of evidence and this should be shown upon arrival. Likewise, the team should use safety equipment when arriving on the scene to ensure that nothing is jeopardized (U.S. Department of Justice, 2008).
To prepare for the search, the team will first document the condition and state of the scene. Before anything is moved, the team should photograph and record screen info of all the workstations involved. It is important to assess the current state of the system before any investigative work is begun. Computers should remain on if they have not yet been turned off, as this will allow for any connections established via illegal actions to remain open (they could be lost should computers be powered off). However, if software is being run on the computer that is damaging the computer/network, the device may be shut off promptly. Back-up servers should be in place to maintain the organization's workflow, in case the servers under scrutiny need to be disconnected for inspection. A continuity of operations plan should be in place and ready to be implemented before the team begins collecting data.
The team will identify potential digital evidence by understanding that digital evidence contains fingerprints, so to speak -- DNA-types of information that are left behind whenever a process is changed. However, evidenced can be easily lost or changed without anyone noticing; therefore, time is of the essence, and as soon as the team arrives it should seek to corral Internet-based evidence, computer-based evidence, and mobile device evidence if at all discerned to be applicable from the accounts of what happened according to participants (National Forensic Science Technology Center, 2015a).
Once data is collected it needs to remain free from contamination. Digital evidence can be lost or damaged in the process of recovery or transference; therefore, it is essential that a copy/image of the data is produced for back-up. This means that the device(s) in question need to be copied onto a separate medium that is clean (i.e., that has not been used before). It is important that the backup medium be free of all data because any information that may be on the medium could potentially end up being examined by the investigation team. Thus, even if a drive has been erased, it should not be used as a backup because unless it has been wiped, content may still exist on the drive and interfere with the investigation.
All digital evidence should be labeled and identified with information regarding where it came from, its purpose in the facility, its precise location when found, and why it was collected. This evidence should then be packaged and shipped in a manner that is secure. Secure transfer should include signing out and signing in packages and ensuring that all data is transferred and monitored via checkpoint processes when delivering and taking delivery.
To ensure that proper storage and chain of evidence is conducted, logs will be kept and maintained of all individuals taking and handing over custody of evidence, from the crime scene investigators to team members in the laboratory where the evidence will be scrutinized. Without a proper chain of evidence, data can be lost; or it could be altered -- and if there is no indication of who handled the evidence last, it becomes an issue of accountability and responsibility.
Approaching the Computer
The next step is to install onto the suspect device(s) software that blocks any changing (i.e., write-blocking software) (National Forensic Science Technology Center, 2015). The potential malware that may exist on the system has the capacity to harm the system further so it is important to destabilize it and/or contain it. A software application could be installed and run in the computer's safe mode to search for malware if the computer has been turned off. This will ensure that the malware is not re-activated when the computer is turned on, as safe mode allows the computer to only run basic operations. Malwarebytes is one such application that can be utilized in this situation to search, scan and detect malware...
However, nothing can be done until the malware actually occurs. With all the different viruses, worms and Trojans, how can security managers possibly predict what malware will occur next? In contrast, a behavioral rule defines legitimate activity in a system. Any activity not matching the profile will cause the security product to be triggered. As rules are not specific to a particular type of attack, they can block malicious
However, cursory studies that have been conducted are either biased because they seem to present a biased review of certain products or are insufficient because of their limitations and shallowness. Those studies that have been considered to be useful are mentioned below. Robert D. Boerner, Joanne Bourquard, Pam Greenberg (2000) comprehensively elaborates the legal aspect of spam. He provides an in-depth review of the present laws in actions and the
Mobile Computing and Social Networks There are many mobile apps in the market that have been designed to cater for various tasks and processes. Mobile apps were initially designed for gaming but improvements have been made to ensure that they can be used for business purposes. Applications have been designed to improve efficiency of mobile devices. Users have been able to make use of mobile phones to replace devices such as
Cyber Crime Task Force "Are computer vulnerabilities growing faster than measures to reduce them? Carelessness in protecting oneself, tolerance of bug-filled software, vendors selling inadequately tested products, or the unappreciated complexity of network connectivity has led to…abuse…" (Lukasik, 2011). The evidence is overwhelming that cyber crimes are not only increasing each year, but the sophistication of the attacks is greater each year and the impacts of attacks are more severe each year
This is problematic, as these kinds of issues could lead to wide spread disruptions with no one knowing or understanding where it came from. For example, if a terrorist group was able to master this tool, they could utilize it to attack Western power grids. (Magnuson, 2013) This would create significant amounts of disruptions without having anyone being able to trace what is happening directly. When this occurs, there is
Bluetooth devices use encryption security and this makes the requirement of a "unique key session key to derive per-packet keys thus avoiding frequent key reuse." (Kennedy and Hunt, 2008, p.4) Kennedy and Hunt report that ZigBee is a reasonably priced low energy consumption two-way CDMA/BA-based wireless communications standard which is based on IEEE 802.15.4 which is referred to commonly as a 'Low Rate Wireless Personal Area Networks (LR-WPANs) and which
Our semester plans gives you unlimited, unrestricted access to our entire library of resources —writing tools, guides, example essays, tutorials, class notes, and more.
Get Started Now