The realities of real forensic investigations in IT….Dec on Risky Business
March 27th, 2008 Drazen Drazic Posted in Dumb Security, Forensics, cyber crime |
This is a topic that is going to be covered again tomorrow in a post by BG. What can IT Security specialists actually really do when investigating an “incident”? Too many kid themselves that they can provide the client with the full service. As good as I think Securus Global is, I would never promote that we can do this properly ourselves without specialist guidance and advice from legals and police type people. Too many heroes out there think they can and that is dangerous. There’s a difference between an investigation and an “investigation” that would be used for a legal case.
Risky Business talks to Declan Ingram from Securus Global on this topic:
http://www.itradio.com.au/security/?p=64
March 28th, 2008 at 9:13 am
DD said, “There’s a difference between an investigation and an “investigation” that would be used for a legal case.”
My question is, why is there a difference ? Is there a potentially very large trap here ?
How can the ‘investigators’ be so sure that their investigation results will not end up in Court one day ?
After all, it might not be their company initiating the legal process. It might be a fired employee, a competitor or a Government agency. (This is a relatively free country, right ?)
There’s a plethora of examples of what I’m talking about, but here’s one for the sake of what I’m getting at:
As a result of your high-level ‘investigation’ into the theft of IP, an employee’s email records are accessed by the companys’ IT people, at the request of management, to see whats going on.
The employee has been discovered sending IP to a competitor via the company email servers.
The employee is dismissed. At the time, the company takes the view that no legal action will be initiated against the employee (to keep it quiet - they don’t want it publicised), however they decide to sack them anyway. The email “investigation” was not conducted in a forensically sound manner.
The sacked employee then initiates action against the former employer, citing unfair dismissal. They are also claiming costs for damage to their reputation, since its unlikely that they will be re-employed. The records of the investigation are subpoenaed by the former employee, & produced at Court.
Do you think the employee might have a good case against their employer ? My bloody oath they might ! And the case is likely to be publicised anyway, which is exactly what the employer was trying to avoid.
My apologies for playing devil’s advocate. I’m simply pointing out the potential traps of allowing the companies’ IT guys play office detective.
March 28th, 2008 at 10:03 am
Big Galoot,
I totally agree with you. It is not good enough to say “We don’t need forensically sound evidence”. Really, then what is the purpose for the investigation. What are you going to do when you find what ever it is you find.
And if you are doing an investigation what are you going to be looking into and how. Will you be potentially looking at what employees have or have not done. Have you thought about the Workplace Surveillance Act (if in NSW) and all your legal requirements there. Are your methods of collection of evidence legal.
Good practice can not be retrospectively fitted later should you find anything just to reduce the upfront cost and complexity of an investigation. Otherwise you would be probably best saving your cash and employing BG’s Ostrich Risk Management Framework.
March 28th, 2008 at 2:00 pm
@BG - Absolutely, I completely agree. There are many situations where, no matter what, a full legal forensic investigation is required.
However, the vast majority of security incidents on the internet are more like this: A system is compromised by an attacker from who came from a country far far away. There logs are only stored locally. There is no IDS, no decent Firewall logs and nothing on the system that can be trusted.
The company wants to know what happened, and how to fix it. Even if they provided the AFP with the address, name and phone number of the person who hacked into their system - nothing could be done - they are far away in a country that does not care.
As I said however, I agree. I would like to see people doing things properly all the time but if that was the case - We wouldn’t be in there doing an investigation, would we ?
This was not a case where I was saying I think this is a good idea, just that this is what is happening, and why. In the cases you mention - employees, IP theft etc sure - there is no point at all in doing anything if you arn’t going to be able to back it up in court.
On the flip side, There are cases were the AFP have been given full forensically sound evidence, the name address and phone number of an Australian Citizen, living in Australia who has been repeatedly hacking into different places and done absolutely nothing. zip, zilch, nadda.
In the case of system compromise, It is very very hard to justify the cost of a full investigation to a business when the chance of success - even in the best cases - is so slim. Companies are far more concerned with finding the extent of the compromise and how to get their business running again.
March 31st, 2008 at 9:54 am
Fair enough.
I should have probably differentiated between an ‘investigation’ - from a civil or criminal perspective, and all other types of ‘investigations’.
My wife occasionally asks me to go and ‘investigate’ the boisterous brush tailed possums who’ve decided to make their home in our roof, keeping us awake at ungodly hours of the night.
By implication (and tone of voice), she wants me to fix the problem. She doesn’t want to know how I’ve fixed it, or where I’ve re-released the captured possums, or need a signed statement for production to a Court.
I’d imagine that ‘investigating’ some internet-related security incidents take on a similar methodology. In other words, the company wants the problem investigated. And they’re not interested in how you fixed the problem. They simply want to get on with the business of making money - as quickly as possible. Fair enough, too.
Irrespective of the regularity of the internet ‘incident’, not all company computer-related ‘incidents’ fall into this category.
Given that shareholders and others have a stake in the profits and losses of large companies, there are sometimes regulatory requirements at play that require a legally sound investigative process takes place (as opposed to the possum methodology).
BG.