Please read the scenario below, research, and answer the question at the bottom of it. Thanks
Discussion – Scoping the Investigation
No unread replies.
No replies.
Throughout this course, we will be using a hypothetical data leakage scenario developed for the US National Institute of Standards and Technology (NIST). Before proceeding, please review the scenario below:
Mr. Iaman Informant was working as a manager of the Technology Development Division for famous international company OOO, which develops state-of-the-art technologies and gadgets.
One day, at a place that Mr. Informant visited on business, he received an offer from ‘Spy Conspirator,’ an employee of a rival company, to leak sensitive information related to OOO’s newest technology. Mr. Informant decided to accept the offer in exchange for large amounts of money, and he began working on a detailed plan to leak the desired data.
Mr. Informant made a deliberate effort to hide his actions and prevent his plan from being uncovered. He discussed it with Mr. Conspirator via e-mail, pretending like they had a legitimate business relationship. He also sent samples of confidential information through his personal cloud storage service. After receiving the samples, Mr. Conspirator asked for direct delivery of storage devices containing the remaining (large volume of) data.
OOO’s information security policies include the following:
Confidential electronic files should only be stored on authorized external storage devices and secured network drives.
Confidential paper documents and electronic files may only be accessed within an allowed time range (from 10:00 AM to 4:00 PM) and with the appropriate permissions.
Unauthorized electronic devices (such as laptops, portable storage, and smart devices) may not be carried onto the company.
All employees are required to pass through the ‘Security Checkpoint’ system upon entering or exiting the building.
Possession of any storage devices (such as HDDs, SSDs, USB memory sticks, and CD/DVDs) is forbidden under the ‘Security Checkpoint’ rules.
In addition, although the company managed separate internal and external networks, and used DRM (Digital Rights Management) / DLP (Data Loss Prevention) solutions in their information security infrastructure, Mr. Informant had sufficient privileges to bypass them. He was also very interested in IT (Information Technology), generally, and had some knowledge of digital forensics.
Despite the risk, Mr. Informant attempted to leave the building with storage devices in his possession, but he and his devices were detected at the security checkpoint, leading to suspicion that he may have been trying to steal OOO data.
The devices in Mr. Informant’s possession (a USB thumb drive and a CD-R) were briefly reviewed at the security checkpoint (protected with portable write blockers), but there was no obvious evidence of any leakage. As such, the devices were subsequently transferred to the digital forensics laboratory for further analysis.
After reading through the NIST data leakage scenario, consider the following question:
“If you were going to exfiltrate data from OOO in electronic format, how would you do it?”
Discuss how your theory (and the facts presented in the scenario) could help inform the scope and direction of your planned digital forensic investigation.
Are there any potential sources of digital evidence that you should include (or exclude) in the course of your inquiry? Provide some examples and explain their potential value or significance.
And, do you think discoveries you make while investigating this case should be used to change your theory or adjust the scope of your investigation?
Last Completed Projects
| topic title | academic level | Writer | delivered |
|---|