Nicholas Thomas, an expert in the field of digital forensics, recently spoke to The Networking Group online meeting about its importance for business owners in an age of cybercrime. As things become increasingly digitised, the opportunities for abuse of digital systems and cybercrime grow.
Following the trail
Nicolas begins with a quote by Dr. Edmond Locard, the father of modern forensics: “For any two points of contact, there is always a cross-transference of material from one to the other.”
In other words, when something occurs, there is always a trail of evidence. While one might not expect it, it is true even in the digital world.
Digital forensics merges computer data recovery methods with rules and guidelines from the legal system to produce a robust audit system.
The investigative process
Nicholas said digital investigators primarily retrieve and preserve evidence of cybercrime in a structured investigation. The key is to follow the scientific method to ensure the investigation is done properly and is replicable by a third party.
Investigators must discover who did what and how they did it. Another critical aspect is maintaining a solid chain of custody of the evidence to ensure nothing is amiss and making sure none of the data is altered in any way.
The final step is to produce a report.
The tools of the trade
Of course, as these are highly technical operations, a specific set of tools must be used, and a rigorous process followed. Work must never be done on a device. Instead, a “copy” of the device’s data must be made and worked on.
Professionals must also use a recognised tool set such as EnCaseID, which is used by law enforcement. This is particularly important, seeing as the investigation could be handed over if something illegal is found. In such a case, the gathered data will then be in a format that New Zealand law enforcement agencies are familiar with.
The Importance of Data
The main target of cybercrime is data. Nicholas explains that data is the most valuable commodity in the modern era. After all, it’s how Facebook makes a large chunk of its money and is practically an industry unto itself.
Data is either the target or a pathway to the actual target. While much cybercrime is mechanical, there’s also a social element—bad faith actors preying on ignorance or carelessness.
Where businesses are concerned
For a business, cybercrime can take a number of forms, such as Industrial espionage, fraud, IP theft, and forgery. Digital forensic investigations can also be used to find evidence of inappropriate use of company devices. These crimes can be perpetuated through an employee or by one.
While Nicholas and his team are called in after a crime occurs, he provides a handy tip for mitigating the risk of it all together. He says that the biggest mistake a company can make is implementing a “bring your own device” policy instead of issuing employees’ hardware. An employee can’t be compelled to hand over their personal property for investigation, plus they will use it for nonwork purposes, which exposes the company data on their device to danger.
Therefore, Nicolas advises issuing hardware. It may be more expensive initially, but it’ll be worth the extra layers of protection.
A note on how data works
Nicolas ends off with a brief explanation of how data works. It can seem quite abstract, and so he uses the metaphor of a book. The data is like content in a book. The book is the device. The data is retrievable through the index page of the book until the index entry is deleted.
While the index page is deleted, the content remains. The average person can’t retrieve it, but digital forensic tools can. This hidden data is often the main target of an investigation.
Unbeknownst to many, deleted data is often retrievable for a while after deletion, but not forever. As such, Nicolas says that it’s important to get an investigation underway fast if you suspect something, or at least clone a device and preserve it—a service which his firm provides.
Conclusion
Forensic investigations are vital for the legal process, an integral tool in the fight against cybercrime, and should always be performed by a professional. Nicholas notes that these investigations are increasingly crucial as the world digitises.
Data is an important aspect of business that many fail to be mindful of. Hopefully, you now know a bit more about it, the importance of safeguarding it, and what to do if you suspect it’s been compromised.
TNG ConnectNZ Online
TNG features members on our online group each fortnight. For further information contact us here.
If you’d like to watch Nicolas’ presentation please see our Youtube video (185) Digital Forensics For Business Owners with Nicolas Thomas from Computer Forensics – YouTube here.
To subscribe to our YouTube channel to stay up to date click here
Want to connect & network with like-minded business owners?
Visit The Networking Group website & register :
www.tng.org.nz/tng-groups/
