Role Of Security Audits On Computer Forensics

When faced with problems as a computer forensics investigator you must be very flexible. There are many different types of computer related crimes in today’s society. They may range from child pornography to identity theft to even insider trading on Wall Street. The possibilities for the criminals in our world to use computers and the Internet against us are endless. The computer forensics or cyber forensics fields are growing but are still learning every day because it is such a young field of study. New things emerge every day that computer forensic investigators must adapt to and begin to learn to help combat these criminals. Investigators will use many tools to help them find incriminating evidence. These investigators must learn these tools inside and out to make sure every test they run can be valid. The computer forensics field is growing rapidly and there are a lot of real world threats that we need these investigators to help us solve.

Implement an information management system (SIM) that can analyze the aggregated logs for abnormal activities, which may be a sign of a compromise or undesired access.

One threat that has become prevalent in the public access computers is the use of key loggers. In this situation, a

When the GCU gathers evidence for later use for the court, sources of evidence can be monitored to detect threatened incidents in a timely manner. The GCU employee’s needs to be aware of suspicious transaction related to any activity in the customer account. Securing intrusion detection systems (IDS) components are important because IDS are often targeted by attackers that want to prevent the IDS from detecting attacks or want to gain access to sensitive information on the IDS, such as host configurations and known vulnerabilities. In monitoring and auditing, the types of activities recognized as suspicious will be different from different business needs. For example, a forensic accountant may look for specific patterns of financial data to trigger suspicion of fraud or theft. A suspicious event might be multiple emails on a sensitive subject from a person that is not involved in the subject. Recommend resources that can be used

* Receive the equipment from the Seattle Police Department with the chain of custody form

The aim of this report is to examine Computer Forensics and Anti Forensics in details, investigation and Analysis techniques, and standard set of procedures which Forensics investigators must follow

From data acquisition, the investigator should move to the process of extracting data. He or she should use special computer forensics software tools to extract important data from various computer devices and networks. The process of extracting data requires the investigator to be knowledgeable about where to search data in the system and the kind of questions to ask (Rogers, 2003). After extracting data, the investigator proceeds to the process of data analysis. By this time, the investigator will probably be having thousands of files. He or she should use computer forensic tools and techniques to analyze the files in order to generate data which is more relevant and concise (Rogers, 2003). The last step of the process of computer forensics involves reporting the analyzed data. The investigators should ensure that the data, which is supposed to be reported, is complete, understandable, and defendable. This will ensure that the final data presented is credible (Rogers, 2003).

In this essay I will be talking about the key guidelines when it comes to investigating computer related crimes, such as what kind of the sections and sub-sections the offence falls under when regarding the ‘law’. I will also analyse the principle that will apply when dealing with the collection data using the digital forensic unit to analyse the data, more so how this is used to make accurate judgment on why the data was in this location and what its purpose or intended use was. Furthermore I will address what kind the authority the ACPO are granted, and further dissect the responsibilities the chief commissioner has. Lastly I will be addressing one the biggest computer related crimes which Cyber Crime and how ACPO created a method for dealing with such crimes, such as dividing the crime into two different categories of Cyber Crime, and how they differ from one another.

One of the primary benefits of files as a data source is the ability to separate and analyze the types of files, which creates a specific signature based on the content and user (Marcella & Menendez, 2008). Data can be pulled from deleted files, slack space on a system’s hard drive, or free space, all of which provides information that can be useful to investigators. The directory location and allocation type for each file informs the data that has been collected, including a time stamp and whether tools have been used to hide the data. Each of these characteristics provides investigators easy-to-access information about a system. In addition, there are a variety of hardware tools that can be used to access data. This technology is fairly common, meaning that associated costs tend to be minimal when retrieving data from files (Purita, 2006).

A computer forensics expert can recover information and computer evidence even if it has been hidden, encrypted, or deleted. In computer forensics, time is of the essence and an investigation must be performed in a timely manner to prevent information from disappearing forever. An important aspect of a computer forensic investigation is that the computer forensics expert must be capable of performing the analysis in a manner that will preserve, identify, extract, document and interpret computer data. The computer forensics analysis must be performed in a manner that conforms with legal requirements so that the results of the forensics investigation will be admissible in court. Simply powering up a computer can result in many files being changed. This may affect the admissibility and reliability of digital evidence. The analysis of electronic evidence includes not only the analysis of documents currently in a computer and those that were previously deleted, but also past versions and alterations of electronically stored documents.

The computer forensics lab must have certain levels of physical security to prevent anyone from accessing the lab. The following security measures would be implemented to assure the integrity of the equipment and information.

The system should be able to block attempts and protect its configuration files as well as logs through cryptographic hashing.

The paper ‘Cloud Computing Log Forensics- The new frontier’ talks about the complication when forensics is applied to the cloud.[1] Since there is no one to one mapping in cloud and cloud forensics involves evidence

Monitoring and logging are important to any information security program. In general, monitoring ensures users are doing legal activities on company systems. To begin with, a risk assessment determines what computers and systems to log, and naturally, the information security team monitors the high-risk systems. Next, trained personnel configure systems to facilitate monitoring and logging to track security incidents with approved system utilities or auditing tools, in other words, scripts, log management software, and security incident event management (ISO, 2005). Also, management will pre-approve tools, and controls will safeguard operational systems during the analysis process. Consequently, monitored systems and security events generates an audit log entry, thereby producing a time-stamped reference trail. In the end, the monitoring and logging policy will aid in protecting electronic protected health information (EPHI) on information systems.

The paper ‘Cloud Computing Log Forensics- The new frontier’ talks about the complication when forensics is applied to the cloud.[1] Since there is no one to one mapping in cloud and