Information States: Storage, Processing, Transmission

• Information is organized, structured data that provides context and enables decision-making.
• Data is raw, unorganized facts without specific purpose or significance, measured in bits and bytes.
• Information States: Information, which is interpreted data, exists in three states: stored, processed, or transmitted.

Transmission

• Transmission involves sending information or data from one place to another, without certainty of receipt at the destination.

Processing

• Processing is manipulating data, like letters, numbers, or symbols, often done by software on stored files.

Storage

• Storage is saving digital data within a storage device for temporary or permanent retention.

Three states of Information:

• Information in transit refers to data being transmitted over a network from a source to a destination.
• Information in process refers to data being transformed from one format to another through processing.
• Information in storage refers to stagnant data residing on a storage medium for future use.

Three states of Data:

• Data at rest refers to data that is stored or archived in physical or electronic storage devices.
• Data in use refers to data actively being accessed or manipulated.
• Data in transit refers to data in motion between different locations or networks.

Common Computer Data:

• Image Data
• Numeric Data
• Text Data
• Video/Audio Data

Components of CIA Triad:

• Confidentiality prevents sensitive information from unauthorized access.
• Integrity maintains the consistency, accuracy, and trustworthiness of data.
• Availability ensures information is readily accessible to authorized parties.

Pillars of InfoSec:

• Confidentiality assures that information is not disclosed to unauthorized individuals.
• Integrity safeguards the accuracy and completeness of vital information.
• Availability ensures authorized users have timely and easy access to information services.
• Authentication establishes the validity of a message or verifies an individual's authorization.
• Non-Repudiation assures that a party involved in a transaction cannot deny its authenticity.

Digital Forensics

• Digital forensics ensures the integrity of evidence in legal cases and investigations, especially in information assurance and security.
• Computer forensics identifies, preserves, analyzes, and presents digital evidence stored on computers or digital devices.
• Computer forensics is used in legal and investigative contexts to uncover, interpret, and document evidence from digital systems.

Key Goals of Computer Forensics:

• Identify evidence related to criminal or unauthorized activities.
• Preserve evidence through proper documentation of handling from collection to court presentation.
• Analyze evidence to extract and interpret information, determining its relevance.
• Present evidence in a manner that is understandable and admissible in court.

Key Goals of Computer Forensics Demonstrated:

• Locating the digital evidence of a crime.
• Reconstructing the sequence of events to demonstrate how the crime was committed.
• Analyzing logs and network traffic to trace attackers and potentially identify them.
• Providing a forensic report and expert testimony as crucial evidence for legal proceedings.

Examples of Computer Forensics Applications:

• Recovering deleted financial records to uncover fraudulent activities.
• Analyzing logs and timestamps to determine when a user accessed specific files.
• Analyzing email headers and content to identify phishing attempts or fraudulent communication.

The Process of Computer Forensics

• Identification: Determine what evidence is needed and where it might be found.
• Preservation: Create an exact copy (forensic image) of the evidence while preventing modifications.
• Analysis: Examine the data to uncover useful information.
• Documentation: Record all findings and maintain a clear chain of custody.
• Presentation: Provide a report that explains the evidence and its significance.

Key Technical Concepts in Computer Forensics:

Digital Evidence

• Digital evidence refers to any data stored or transmitted digitally that can be used in investigations or legal proceedings.
• Digital evidence
  • Emails trace communication, id phishing
  • Log files record login attempts, accesses
  • Images and videos might contain incriminating evidence or metadata.
  • Chat histories are conversations from platforms used in harassment or fraud cases.

Characteristics of Digital Evidence:

• Fragile: Digital evidence can be easily modified or deleted.
• Reproducible: Digital evidence can be copied exactly without altering the original.

Chain of Custody

• Chain of custody is a documented process that tracks evidence handling from collection to court presentation, ensuring it is not tampered with or compromised.

Steps in the Chain of Custody:

• Collect evidence.
• Assign a unique identifier.
• Maintain a detailed record.
• Store the evidence in a tamper-proof environment.

Hashing

• Hashing is generating a unique digital fingerprint for a file or data using algorithms like MD5 or SHA-256.

Purpose of Hashing:

• Verify Integrity: Ensure that the evidence has not been altered.
• Identify Duplicates: Hashing can be used to quickly compare files and identify duplicates during investigations.

Data Acquisition

• Data acquisition is creating an exact copy of digital data from a storage device for forensic analysis.

Types of Acquisition:

• Live Acquisition: Performed on a running system.
• Static Acquisition: Performed on a powered-off device.

Windows System Artifacts

• Windows System Artifacts are traces of activity generated by the operating system, applications, or users. They can reveal:
  • When files were created, accessed, or deleted.
  • Which programs were installed or run.
  • Evidence of user logins, browsing history, and system errors.

Common Types of Windows System Artifacts:

• Event Logs record system events, application usage, security incidents, and user logins.
• Registry Files store system and application settings, as well as user preferences.
• Prefetch Files are created by Windows to speed up application loading.
• Browser Artifacts are data left behind by web browsers, such as history, cookies, and cached files.
• Recycle Bin is a folder where deleted files are temporarily stored before permanent deletion.

Performing Data Storage Investigations Tools:

• FTK Imager helps to create forensic images of storage devices and preview their contents.
• Autopsy is for analyzing digital evidence, recovering deleted files, and creating timelines.
• EnCase is a tool for evidence acquisition, analysis, and reporting.

Information Assurance (IA)

• Information Assurance (IA) is managing risks associated with information processing, storage, and transmission.
• IA ensures that information remains confidential, accurate, and available to authorized users.

Goals and Objectives of IA

• Minimize vulnerabilities to reduce the risk of security breaches.
• Limit damage Implement strategies to reduce harm if a breach occurs.
• Ensure efficient recovery Develop contingency plans for quick restoration.

Basic IA Concepts:

• Access Controls are mechanisms that regulate who can access systems and data.
• Physical Controls are security measures that prevent unauthorized physical access.
• Logical Controls are digital safeguards that protect data and restrict access.
• Individual Accountability means each user is uniquely identifiable and responsible for their actions.
• Audit Trails are records that document system access, modifications, and other activities.

Basic Categories of Information:

• Personal & Private Information: Data must be protected to ensure privacy and security.
• National Security Information: Data that, if exposed, could threaten national security.
• Business Information: Proprietary corporate data that provides a competitive advantage or supports operations.

IA Models:

• IA models provide structured frameworks for securing, classifying, and managing information.

IA Models:

• The Information Value Model: Protecting information should be based on its importance, cost, and potential risks.

• HIGH-VALUE INFORMATION needs stronger security.

• TIME-SENSITIVE INFORMATION may lose value.

• OVER-PROTECTION wastes resources; UNDER-PROTECTION increases risk.

• Cost to Produce, Cost to Replace, Impact of Exposure, Legal Requirements

• The Need-To-Know (NTK) Model restricts information access only to those who need it for their job functions.

• Role-Based Access Controls allows Employees to only access necessary data.

• Prevents Insider Threats to reduces the risk of leaks from within the organization.

The CIA Model

• Foundation of information security, ensuring data protection and system reliability.
• Confidentiality ensures data is only accessible to authorized users.
• Integrity ensures data remains accurate and unaltered.
• Availability ensures data is accessible when needed.

PDRD Model

• The Protect-Detect-React-Deter (PDRD) Model provides a proactive cybersecurity strategy:
• Implement security measures: Firewalls, antivirus software, access controls.
• Identify threats in real-time: Intrusion detection system, log monitoring.
• Take action against security breaches: Incident response teams, forensic investigations.
• Prevent future attacks: Strict security policies, prosecution of cybercriminals.

Summary of IA Models:

• INFORMATION VALUE MODEL: Adjusts security based on data importance.
• NEED-TO-KNOW (NTK) MODEL: Restricts access based on roles.
• CIA TRIAD :Ensures Confidentiality, Integrity, and Availability.
• PDRD MODEL: Protects, detects, reacts, and deters cyber threats.

Key Considerations for IA Success:

• Continuously monitor and update security.
• Train employees on security best practices.
• Develop strong policies for data classification and protection.
• Ensure compliance with industry regulations and standards.