National Critical Infrastructure (NCI) Threats

Threats to National Critical Infrastructure (NCI)

• Critical infrastructure threats aim to disrupt sectors by targeting infrastructure essential for national security, public health, safety, and economic stability.

Key Infrastructure Threats

• Cyber attacks on energy grids cause large-scale blackouts that affect hospitals and transportation.
• Telecommunications disruption interferes with essential communications for emergency services, government, and military.
• Water supply attacks can poison supplies or damage systems.
• Transportation system attacks can cause accidents, delays, affecting traffic and railways.
• Healthcare infrastructure breaches endanger patient care by locking out systems or stealing health information.
• Supply chain attacks compromise food, medicine, and essentials, which can have widespread societal impacts.
• Financial systems sabotage destabilizes economies and leads to widespread panic.
• Satellite and space system attacks threaten national security and emergency response.

Combating Cybercrime and NCI Threats

• Protecting critical infrastructure requires combining technology, policy, and international collaboration.

Key Measures

• Strengthening cybersecurity involves multi-factor authentication, encryption, and regular security audits.
• Awareness and training educate employees and the public about cybersecurity.
• International cooperation shares intelligence and responds to transnational threats.
• Legislation and enforcement implement laws to prosecute cybercriminals.
• Incident response and recovery establish protocols for quick detection and damage minimization.

Cybercrime Investigation Process

• Investigating cybercrime involves a structured process to gather, analyze, and preserve digital evidence while maintaining data integrity.

Initial Assessment and Incident Identification

• A report is received from a victim, organization, or security system alerting authorities to suspicious activity.
• The nature of the cybercrime (e.g., phishing, ransomware) needs to be classified to determine its scope and impact.
• As much initial information as possible should be recorded and any malicious activity be frozen without altering evidence.

Preservation of Evidence

• Digital evidence collection secures all computers, storage devices, and networks involved.
• Collection may include seizing hardware, copying drives, or obtaining access logs

Analysis of Digital Evidence

• Data recovery and extraction involve analyzing the collected data for relevant information, which might require decrypting data, recovering deleted files, or examining histories.
• Network traffic is analyzed to identify suspicious patterns, potentially tracing the attack origin.
• Timeline construction reconstructs events sequences to understand activities.

Identification and Tracking of Suspects

• Attribution uses evidence to trace the crime back to a specific individual, group, or device.
• Collaboration with internet service providers, social media platforms, and international law agencies is necessary due to cybercrime crossing jurisdictions.

Legal Procedures and Warrants

• Warrants may be necessary to access private data, seize devices, or conduct surveillance, depending on legal requirements.
• Investigations must comply with privacy laws to avoid infringing rights or invalidating evidence.

Reporting and Documentation

• A forensic report documents all findings, methodologies, and tools used for legal review, written so those outside the field can understand.

Post-Incident Review

• Effectiveness of the response is assessed, and areas for improvement are identified.
• Findings should be shared to improve cybersecurity practices.

Strategies for Cybercrime Prevention

• Regular software updates prevent hackers from exploiting vulnerabilities.
• Strong, regularly changed passwords and MFA provide extra security.
• Cybersecurity training for employees addresses a common entry point for cybercriminals.
• Secure networks and firewalls shield systems from unauthorized access.
• Regular data backups help recover from ransomware or other incidents.
• An incident response plan helps to minimize damage and downtime.

Ways of Curbing/Preventing Cybercrime

• A multi-layered approach is required that involves individuals, organizations, and governments working together.

Effective Strategies

• Education and awareness inform people about cybersecurity and common tactics used by cybercriminals.
• Advanced security tools like antivirus software, firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) are needed.
• Sensitive data needs to be encrypted so that, even if accessed by cybercriminals, it remains unreadable
• MFA requires two or more verification factors, making it harder for cybercriminals to access systems.
• Governments need to enforce laws and policies against cybercrime, deterring criminals and setting consequences.
• Organizations need to provide cybersecurity training for employees.
• Secure backups and a robust incident response plan help organizations recover quickly.
• Limit access control via the principle of least privilege to reduce risk.
• Avoid using public Wi-Fi for sensitive transactions in favour of VPNs (Virtual Private Network) to secure internet connections.

Technical Aspects of Cybercrime Investigation

• Digital forensics involves collecting, preserving, analyzing, and presenting digital evidence.
• Forensic analysts retrieve data (deleted files, logs and traces) from devices after attack

Common Threats and Types of Attacks

• Phishing and social engineering trick people into providing sensitive information or downloading malware.
• Ransomware encrypts a victim's data and demands payment for its release and is common among cybercriminals and terrorists.
• DDoS attacks overwhelm a target with traffic, rendering services unavailable, and are sometimes used against critical infrastructure.
• APTs are prolonged attacks aimed at stealing sensitive information over time, often in state-sponsored or terrorist operations.
• Zero-day exploits target unknown vulnerabilities in software or hardware to avoid detection.
• Cybercriminals create botnets with hijacked IoT devices, to conduct DDoS attacks or spread malware.
• MITM attacks intercepts and manipulates communications between parties to steal data or credentials.

Defense Mechanisms Used by Criminals and Terrorists

• Anonymization and encryption involves tools like Tor, VPNs, and encrypted messaging apps.
• Data obfuscation disguises files or changes metadata to evade detection.
• The dark web conducts actions that are harder to trace.
• Routing traffic through multiple proxy servers or compromised systems makes tracing more difficult.
• Steganography hides data within other file types to conceal its existence.
• Anti-forensic techniques hinder forensic analysis.

Effective Defenses Against Cybercrime

• IDPS monitor traffic and block attacks real-time.
• Governments and organizations share intelligence on emerging threats.
• EDR solutions continuously monitor devices and respond to threats before they escalate.
• Behavioral analytics helps spot anomalies, potentially indicating cyber attacks.
• Secure communication channels use strong encryption.
• Cybersecurity awareness programs reduce human vulnerabilities.

Successful Use of Online Social Networks for Cybercrime Investigation

• OSNs enable law enforcement to gather data, identify suspects, and understand crime patterns.
• Investigatiors can gain access to a suspect's online identity, friends, and connections, through OSNs
• Law enforcement agencies are able to track cybercriminal activity, sometimes in private groups, and use undercover profiles.
• OSNs hold evidence like photos, videos, or location tags to build timelines.
• Metadata helps trace a suspect's movements and analyze activity patterns.
• OSINT tools analyze public information to monitor cyber threats.
• Agencies set up social media accounts to gather tips from public.
• Investigators create profiles to join cybercriminal groups.
• Machine learning algorithms recognize patterns in social media data to suggest illegal activity.
• Social networks help share leads, intelligence, and suspect profiles to allow different investigative teams to track suspects or analyze data across jurisdictions.

Concepts in Computer and Network Forensics

• Network forensics involves monitoring and analyzing network traffic to gather information, detect intrusions, and create legal evidence.

Key Concepts

• Digital evidence is data stored or transmitted in binary form, including emails, logs, images, and files.
• Chain of custody is a log showing the handling, transfer, and preservation of evidence.
• Incident response involves immediate actions to identify and mitigate a cyber incident.
• Data recovery are techniques to used retrieve deleted, encrypted, or damaged data.
• File carving is a way to recover files and fragments from unallocated on a storage device.

Current Trends

• With increasing cloud adoption, forensic investigators face new challenges in cloud environments.
• The growth of IoT devices has introduced new sources of evidence, such as smart home devices and wearables.
• AI tools are increasingly used to analyze large data sets, detect anomalies, and identify patterns in digital evidence.
• Forensic tools and techniques help to trace transactions on blockchain networks.
• Forensics integrates into broader cybersecurity strategies, combining with monitoring, threat intelligence, and forensics to prevent and respond to incidents.

Methods Used in Computer and Network Forensics

• Disk imaging creates an exact copy of a storage device for analysis.
• Analyzing network traffic detects suspicious activities.
• Examining log identify patterns indicating a security incident.
• Analyzing data uncover information not permanently saved.
• Mobile forensics extracts data from mobile devices.
• Reverse engineering deconstructs software to understand its purpose, structure, and functionality.
• Forensic software perform various forensics tasks

Skills and Knowledge in Digital Evidence Collection

• Professionals require specific skills and knowledge to handle, analyze, and interpret digital data effectively and lawfully.

Key Areas

• Knowledge of forensics tools like EnCase and FTK is essential.
• Skills in recovering deleted, corrupted, or hidden data are required.
• Network forensics involves understanding network protocols, monitoring traffic, identifying breaches.
• The ability to identify and examine malware is needed.
• Familiarity with programming languages (like Python) can assist in automating forensic processes.
• Knowledge of documenting evidence collection maintains its integrity.
• Awareness of laws covering digital evidence.
• Understanding the ethical boundaries in digital investigations.
• The ability to interpret complex data sets and distinguish between valuable data.
• Skills in linking data sources to establish patterns.
• Knowledge of writing clear, detailed reports for court.
• Precision is crucial in analyzing digital evidence to avoid misinterpretation.
• Clear communication is needed to explain technical findings.
• The ability to adapt and find solutions when working with encrypted platforms.

Additional Cybersecurity Knowledge

• Incident response is required to secure systems and limit damage.
• Knowledge of identifying current cyber threats, understanding attack vectors, and predicting future cyber risks is a necessity.
• Understanding encryption methods is good practice.
• Developing skills requires education, practice, and continual learning.

Policies, Legal Issues, Jurisdiction and Privacy Issues in Cybercrime

• Cybercrime involves policies, frameworks, complexities, and privacy concerns.

Areas

• Cybercrime policies are laws regulating the use of digital technologies.
• National cybersecurity plans aim to improve a country's security.
• International agreements regulate matters of concern such as cybercrime.
• Corporate policies are principles governing staff and decision makers.
• Public awareness campaigns educate to reduce cybercrime risks, like phishing and identity theft.
• Legal issues are matters arising in the context of the law.
• Cybercrimes laws provide standards of behaviour for internet use
• Enforcement is compelling compliance where digital evidence is identified.
• Penalties are punishments imposed for breaking cybercrime laws.
• Criminal activities that occur across borders
• MLATs assist countries in gathering evidence for criminal cases.

Potential Issues

• Extradition is the process by which a criminal suspect is handed over for trial.
• Legal practices are used to prevent or limit extradition.
• Conflicting laws lead to countries having differing legal definitions.
• Data protection laws protect personal information processes.
• Surveillance monitors online activity to prevent cybercrime.
• Balancing anonymity online with accountability is challenging.
• Identity theft is where criminals acquire personal information to commit fraud.

Introduction to Cyber Laws and Counter Measures

• Also known as internet or digital, cyber law refers to the legal framework governing the use of the internet, that encompasses a wide range of legal issues.

Key concepts within the parameters

• Intellectual property protects rights to creations like software and websites.
• Data protection and privacy regulates the collection and storage of personal data.
• Cybercrime laws address illegal activities conducted online (hacking, phishing).
• E-commerce regulations govern online transactions.
• Balancing free speech with issues such as defamation is necessary
• Cybersecurity laws protect information systems from cyber threats.

Nigeria's Cyberlaw

• The Cybercrime Act of 2015 provides the legal framework with related offences.

Key Provisions Include

• The repeated use of electronic communication
• Using a computer to harm national interests
• Misusing personal information
• Unauthorized access to computer systems
• Using the internet to defraud others
• Publishing or sharing of online illicit content

Regulations in the United States

• The CFAA (1986) is key legislation addressing cybercrimes.
• Fraud: Defrauding via computer systems.
• Online Harassment: Threatening or harassing via digital means.

Regulations in China

• The Cybersecurity Law enforces strict regulations on digital activity.
• There are penalties for distributing harmful material.

Regulations in the United Kingdom

• The Computer Misuse Act governs cyber offenses.
• Penalties exist for disrupting access to services

Regulations in India

• The IT Act governs cyber offenses.
• Publishing or transmitting indecent material is an offense.

Areas of Law and differences between Jurisdictions

• Frameworks of Cyberlaw vary globally, reflecting each country's priorities and legal system.
• Cybercrime Act aligns with international standards in terms of offenses and penalties, enforcement is critical to their success.

Countermeasures

• Measures prevent, detect, and respond to cyber threats.

Aims

• Ensuring safety and security in digital environments.
• Compliance with legal frameworks is a necessity, regulations like the GDPR
• A requirement for organizations is to implement best practices in data encryption.
• A plan to outline steps to be taken when a cyber incident occurs.
• Regular training on best practices and legal obligations to reduce human error.
• Collaboration with industry peers and agencies
• Utilizing laws to pursue action against cybercriminals .
• International cooperation can help address and mitigate cybercrime.
• Legal frameworks must evolve alongside technological advancements.

Cyber Law Application

• Cyberlaw varies across different regions and different legal disciplines, and tech

Examples

• Facilitating cooperation among countries.
• Budapest Convention: an international treaty aimed at harmonizing national laws and facilitating international cooperation.
• GDPR: a comprehensive data protection regulation.
• APEC Cybersecurity Framework enhancing cybersecurity cooperation and capacity building.

Regulations By Country

• Nigeria: cybercrimes

• South Africa: protection of information

• Kenya: regulates data

• Egypt: combats cybercrimes

• Morocco: regulates e-signatures

• Ghana: regulates signatures

• Germany: regulates the processing of personal data

• France: provides rights to individuals

• Canada: legislation on the use and collection of data

• Mexico: comprehensive protection of personal data

• Argentina: protection of personal legislation

• Brazil: framework that establish internet principles and use

• China: comprehensive data

• Japan: regulates personal legislation

• India: cyber laws

Nigeria's Cyber Laws

• Framework is the set of guidelines

Examples

• Cybersecurity (Prohibition, Prevention, Etc.) Act to regulate cybercrimes
• NITDA Act to protect data

Bodies

• National Cybersecurity Coordination Centre (NCCC) to coordinate responses
• Oversees IT development and protection.
• National Cybersecurity Policy (2021)

Additional Responses

• Incident Reporting increase awareness
• Capacity Building initiatives for law enforcement

The United States Laws

• Mix of federal and state laws : Computer Fraud and Abuse Act (CFAA), rely on laws

Agencies

• Federal Trade Commission (FTC) regulate matters and protection

Focus

• Countermeasures in sharing information on crime

European Union

• GDPR regulates data in member states

Bodies

• Each country regulate data, EDPB compliance

Laws in India

• Technology Act amendements

Responders

• CERT regulate responses

Guidelines in the UK

• Computer Act regulate data

Protection

• ICO regulate guidance

Challenges and Opportunities for Enforcement of Cyber Law in Nigeria

Challenges

• Lack of Legal personnel and resources to investigate crimes
• Short fall in awareness and capacity
• Judicial framework deficiency
• Corruption and fraud cases exist
• Collaboration limited to outside bodies
• Technology deficient in monitoring

Advantages

• International organizations
• Employees capacity building
• Public and aware campaigns
• Legislative potential
• Improved tech for security
• Involvement to private
• Updated policies