PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT...
-
Upload
theodora-woods -
Category
Documents
-
view
221 -
download
2
Transcript of PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT...
![Page 1: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/1.jpg)
PPB Forensics – May 2010
IP TheftIT Forensic Solutions
Chris HatfieldSenior Manager, IT Forensics
![Page 2: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/2.jpg)
Risk Management
The process of determining the maximum acceptable level of overall risk to and from a proposed activity, then using risk assessment techniques to determine the initial level of risk and, if this is excessive, developing a strategy to ameliorate appropriate individual risks until the overall level of risk is reduced to an acceptable level.
http://en.wiktionary.org/wiki/risk_management
![Page 3: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/3.jpg)
Security Triad
![Page 4: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/4.jpg)
Security Triad
![Page 5: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/5.jpg)
Authentication
![Page 6: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/6.jpg)
Layer 1
![Page 7: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/7.jpg)
Layer 2
![Page 8: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/8.jpg)
Layer 3
![Page 9: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/9.jpg)
Sources
A CB
![Page 10: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/10.jpg)
Mobile Devices
A E
G I
C
M ON
B
F H J
K L
D
![Page 11: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/11.jpg)
Hard Copy
BA C
![Page 12: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/12.jpg)
Web mail, mail clients and mail servers.
Email Communication
B CA
![Page 13: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/13.jpg)
Local, Remote and Hosted.
Data Locations
BA C
![Page 14: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/14.jpg)
Pro-Active Solutions
![Page 15: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/15.jpg)
Pro-Active Solutions
• Data transfer restrictions• Internet Logging• Personal email restrictions• Disable unnecessary media connections (USB/CD)• Monitor USB connections• Restrict working hours on IT equipment• Monitor/log printing habits• Monitor customer relationship software• Restrict access to only data they require access to• Log user activity• Keep reliable backups• Multi user authentication
![Page 16: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/16.jpg)
Re-Active Solutions
POLICE POLICE POLICE POLICE POLICE POLICE POLICE POLICE POLICE
![Page 17: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/17.jpg)
Re-Active Solutions
• Control crime scene• Equipment• Locations• People
• Contain evidence• Forensic image• Backup tapes• Physical segregation
• Evidence continuity• Do not touch original• Document all actions
![Page 18: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/18.jpg)
Re-Active Solutions
• Conduct Forensic Analysis• Time of compromise• Extent of compromise• Threat assessment• USB access lists• Internet activity• Events timeline• Personal email activity• Business email activity• Printing activity• File access
![Page 19: PPB Forensics – May 2010 IP Theft IT Forensic Solutions Chris Hatfield Senior Manager, IT Forensics.](https://reader035.fdocuments.us/reader035/viewer/2022062313/56649cc55503460f9498f247/html5/thumbnails/19.jpg)
Questions
PPB Forensics – May 2010
Joe DicksPartner, Melbourne
03 9269 4209 [email protected]
Phillip RussoDirector, Perth08 9216 7634
Andrew McLeishSenior Manager, Melbourne
03 9269 4276 [email protected]
Chris HatfieldSenior Manager, Sydney
02 8116 [email protected]