information technology audit forensic techniques n.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
Information Technology Audit & Forensic Techniques PowerPoint Presentation
Download Presentation
Information Technology Audit & Forensic Techniques

Loading in 2 Seconds...

play fullscreen
1 / 85

Information Technology Audit & Forensic Techniques - PowerPoint PPT Presentation


  • 151 Views
  • Uploaded on

Information Technology Audit & Forensic Techniques. ACG 6936 Summer 2007. Grover Kearns, PhD, CPA. IT Forensic Techniques for Auditors Presentation Focus. Importance of IT Forensic Techniques to Organizations Importance of IT Forensic Techniques to Auditors

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

Information Technology Audit & Forensic Techniques


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
    Presentation Transcript
    1. Information Technology Audit & Forensic Techniques ACG 6936 Summer 2007 Grover Kearns, PhD, CPA

    2. IT Forensic Techniques for AuditorsPresentation Focus • Importance of IT Forensic Techniques to Organizations • Importance of IT Forensic Techniques to Auditors • Audit Goals of Forensic Investigation • Digital Crime Scene Investigation • Illustration of Forensic Tools • A Forensic Protocol

    3. Forensic Computing Defined Forensic Computing is the process of identifying, preserving, analyzing, and presenting digital evidence in a manner that is legally acceptable in a court of law Our interest is in … • Identifying and preserving evidence, • “post-mortem” system analysis to determine extent and nature of attack, and • the forensic framework

    4. Importance of IT Forensic Techniques to Organizations Corporate Fraud Losses in 2004 • Cost companies an average loss of assets over $ 1.7 million • A 50% increase over 2003 • Over one third of these frauds were discovered by accident, making "chance" the most common fraud detection tool. • PriceWaterhouseCoopers, Global Economic Crime Survey 2005

    5. Importance of IT Forensic Techniques to OrganizationsThe New Corporate Environment • Sarbanes-Oxley 2002 • COSO and COBIT • SAS 94 and SAS 99 • ISO 9000 and ISO 17799 • Gramm-Leach-Bliley Act • US Foreign Corrupt Practices Act …all of these have altered the corporate environment and made forensic techniques a necessity!

    6. Importance of IT Forensic Techniques to AuditorsSAS 99 SAS No. 99 - Consideration of Fraud in a Financial Statement Audit - requires auditors to … • Understand fraud • Gather evidence about the existence of fraud • Identify and respond to fraud risks • Document and communicate findings • Incorporate a technology focus

    7. Importance of IT Forensic Techniques to OrganizationsIntellectual Property Losses • Rapid increase in theft of IP – 323% over five year period 1999-2004 • 75% of estimated annual losses were to an employee, supplier or contractor • Digital IP is more susceptible to theft • Employees may not view it as theft

    8. Importance of IT Forensic Techniques to OrganizationsNetwork Fraud • Companies now highly reliant on networks • Networks increasingly vulnerable to attacks • Viruses, Trojans, Rootkits can add backdoors • Social Engineering including Phishing and Pharming • Confidential and proprietary information can be compromised • Can create a corporate liability

    9. Net Detector

    10. Technology People Policies Processes Importance of IT Forensic Techniques to OrganizationsSecurity Challenges • Technology expanding and becoming more sophisticated • Processes evolving and integrating with technologies • People under trained • Policies outdated • Organizations at risk

    11. Importance of IT Forensic Techniques to Auditors • Majority of fraud is uncovered by chance • Auditors often do not look for fraud • Prosecution requires evidence • Value of IT assets growing Treadway Commission Study … • Undetected fraud was a factor in one-half of the 450 lawsuits against independent auditors.

    12. Importance of IT Forensic Techniques to AuditorsAuditor’s Knowledge, Skills, Abilities • Accounting • Auditing • IT (weak) Needed … • Increased IT knowledge • Fraud and forensic accounting knowledge • Forensic investigative and analytical skills and abilities

    13. Importance of IT Forensic Techniques to AuditorsKnowledge, Skills, Abilities: Needs Auditor’s need KSAs to … • Build a digital audit trail • Collect “usable” courtroom electronic evidence • Trace an unauthorized system user • Recommend or review security policies • Understand computer fraud techniques • Analyze and valuate incurred losses

    14. Importance of IT Forensic Techniques to AuditorsKSA Needs (cont.) • Understand information collected from various computer logs • Be familiar with the Internet, web servers, firewalls, attack methodology, security procedures & penetration testing • Understand organizational and legal protocols for incident handling • Establish relationships with IT, risk management, security, law enforcement

    15. Audit Goals of a Forensic Investigation • Uncover fraudulent or criminal cyber activity • Isolate evidentiary matter (freeze scene) • Document the scene • Create a chain-of-custody for evidence • Analyze digital information • Communicate results

    16. Audit Goals of a Forensic InvestigationImmediate Concerns • What is level of certainty that a problem exists? • Is this a criminal act? • Child porn, money laundering • When should law enforcement be involved? • Can the system be isolated? • Is a subpoena necessary? • Is the intrusion internal or external? • Are suspects known? • Is extent of loss/damage known?

    17. Audit Goals of a Forensic InvestigationImmediate Response • Shut down computer (pull plug) • Bit-stream mirror-image of data • Begin a traceback to identify possible log locations • Contact system administrators on intermediate sites to request log preservation • Contain damage • Collect local logs • Begin documentation

    18. Implement measures to stop further loss Communicate to management and audit committee regularly Analyze copy of digital files Ascertain level and nature of loss Identify perpetrator(s) Develop theories about motives Maintain chain-of-custody Audit Goals of a Forensic Investigation Continuing Investigation

    19. Digital Crime Scene Investigation Goal: Determine what fraud events occurred by using digital evidence Three Phases: • Preserve & Document Scene • Analyze/Search & Document Data • Reconstruct & Document Fraud Event

    20. Digital Crime Scene InvestigationScene Preservation & Documentation • Goal: Preserve the state of as many digital objects as possible and document the crime scene. • Methods: • Shut system down • Unplug (best) • Do nothing • Bag and tag

    21. Treat every incident as if it will end up in a criminal prosecution. Digital Crime Scene Investigation Investigative Axiom

    22. Digital Crime Scene InvestigationIncidents & Investigations • Incident/Crime: An event that violates a policy or law • Investigation: A process that develops and tests hypotheses to answer questions about events that occurred

    23. Audit Goals of a Forensic InvestigationRules of Evidence • Complete • Authentic • Admissible • Reliable • Believable

    24. Audit Goals of a Forensic Investigation Requirements for Evidence Computer logs … • Must not be modifiable • Must be complete • Appropriate retention rules

    25. Digital Crime Scene InvestigationProblems with Digital Investigation • Timing essential – electronic evidence volatile • Auditor may violate rules of evidence • NEVER work directly on the evidence • Skills needed to recover deleted data or encrypted data

    26. Digital Crime Scene InvestigationExtract, process, interpret • Work on the imaged data or “safe copy” • Data extracted may be in binary form • Process data to convert it to understandable form • Reverse-engineer to extract disk partition information, file systems, directories, files, etc • Software available for this purpose • Interpret the data – search for key words, phrases, etc.

    27. Digital Crime Scene InvestigationTechnology • Magnetic disks contain data after deletion • Overwritten data may still be salvaged • Memory still contains data after switch-off • Swap files and temporary files store data • Most OS’s perform extensive logging (so do network routers)

    28. Track Sector (Clusters are groups of Sectors) Cylinder Disk Geometry

    29. Slack Space End of File Slack Space Last Cluster in a File

    30. Digital Crime Scene InvestigationOrder of Volatility • Preserve most volatile evidence first • Registers, caches, peripheral memory • Memory (kernel, physical) • Network state • Running processes • Disk • Floppies, backup media • CD-ROMs, printouts

    31. Digital Crime Scene InvestigationDigital Forensic Investigation A process that uses science and technology to examine digital objects and that develops and tests theories, which can be entered into a court of law, to answer questions about events that occurred. IT Forensic Techniques are used to capture and analyze electronic data and develop theories.

    32. Illustration of Forensic Tools Forensic Software Tools are used for … • Data imaging • Data recovery • Data integrity • Data extraction • Forensic Analysis • Monitoring

    33. Data ImagingEnCase • Reduces internal investigation costs • Platform independent • Automated analysis saves time • Supports electronic records audit • Creates logical evidence files — eliminating need to capture entire hard drives

    34. Data ImagingEnCase • Previews computers over the network to determine whether relevant evidence exists: • Unallocated/allocated space • Deleted files • File slack • Volume slack • File system attributes • CD ROMs/DVDs • Mounted FireWire and USB devices • Mounted encrypted volumes • Mounted thumb drives

    35. Data RecoveryFile Recovery with PC Inspector

    36. Data EradicationSecurely Erasing Files

    37. Data IntegrityMD5 • Message Digest – a hashing algorithm used to generate a checksum • Available online as freeware • Any changes to file will change the checksum Use: • Generate MD5 of system or critical files regularly • Keep checksums in a secure place to compare against later if integrity is questioned

    38. Data IntegrityMD5 Using HashCalc

    39. Data IntegrityHandyBits EasyCrypto

    40. Data IntegrityPrivate Disk

    41. Data MonitoringTracking Log Files

    42. Data MonitoringPC System Log

    43. Security Software Log Entries

    44. Free Log Tools

    45. Audit Command Language (ACL) • ACL is the market leader in computer-assisted audit technology and is an established forensics tool. Clientele includes … • 70 percent of the Fortune 500 companies • over two-thirds of the Global 500 • the Big Four public accounting firms