SAMPLESAMPLE

A Guide to the

Cybercrime Investigation
Body of Knowledge

Purposee

SAMPLE
im

Cr

sk

Process

PeopleStrategy

Ri

Laws

Technology

Response

Tactics

Many of the designations used by manufacturers and sellers to distinguish their products are claimed
as trademarks. Where those designations appear in this book, and the publisher was aware of a
trademark claim, the designations have been printed with initial capital letters or in all capitals.
The authors and publisher have taken care in the preparation of this book, but make no expressedor implied warranty of any kind and assume no responsibility for errors or omissions. No liability is
assumed for incidental or consequential damages in connection with or arising out of the use of theinformation or programs contained herein.
All rights reserved. Printed in the United States of America. This publication is protected bycopyright, and permission must be obtained from the publisher prior to any prohibited reproduction,
storage in a retrieval system, or transmission in any form or by any means – electronic, mechanical,
photocopying, recording, or likewise.
All statements of fact, opinion, or analysis expressed are the authors’ alone and do not necessarilyreflect the official positions or views of the Department of Justice (DOJ) or any other U.S. government
agency. Relevant chapters have been reviewed by DOJ to prevent the disclosure of classified or otherwise
sensitive information.
The Publisher;

SAMPLECIBOK Editorial Committee

Copyright©2016 CIBOK Editorial Committee.
All Right Reserved.

Sponsored by Trend Micro, Incorporated.

2

Authors
Executive Editor
Shane Shook (PhD) is a well-known veteran of information security and response engagements withnearly 30 years of experience spanning government and industry IT risk management issues. He has
led forensic analysts and provided expert testimony in many of the most notorious breaches acrossmost industry sectors. He has also served as expert witness in related (international and US) federal,
civil and commercial disputes. He currently serves on the advisory boards of several emerging
security technology companies. He is a contributing author and editor of several books and a frequent
keynote or guest speaker.

Authors and Contributors
Judith H. Germano is the founding member of Germano Law LLC, a law firm specializing in advising
companies on cybersecurity governance and data privacy issues. Ms. Germano is an Adjunct
Professor at New York University (NYU) School of Law and a Senior Fellow at the New York
University Center for Cybersecurity, where she leads NYU’s task force of corporate executives andsenior government officials focusing on emerging cybersecurity issues and solutions. Previously, Ms.
Germano served as Chief of Economic Crimes at the U.S. Attorney’s Office for the District of New

SAMPLE

Jersey, and was a federal prosecutor for 11 years. Before joining the U.S. Attorney’s Office, she
worked at the multinational law firm, Shearman & Sterling LLP, in New York City. Ms. Germano’s
publications include Cybersecurity Partnerships: A New Era of Collaboration and After the Breach:
Cybersecurity Liability Risk.

Craig W. Sorum is a 25-year veteran of the Federal Bureau of Investigation (FBI) where he conducted
and supervised hundreds of domestic and international cybercrime investigations while assigned tofield offices in El Paso, TX, Washington, D.C., Cedar Rapids, IA and Minneapolis, MN. Craig received
awards for significant cyber investigations as a field agent and was selected as a“Federal 100
Award”winner for top IT managers in government for his accomplishments as Chief of the FBI’s
Law Enforcement Online Unit at FBIHQ. Following the Bureau, Craig was employed as a Senior
Manager of Information Security at a Fortune 500 defense and aerospace company where he was
responsible for all cyber investigations and threat intelligence matters. Craig is currently working asa cyber security management consultant.
David Cowen is a Certified SANS Instructor, CISSP, and GIAC Certified Forensic Examiner. He has
been working in digital forensics and incident response since 1999 and has performed investigations
covering thousands of systems in the public and private sector. Those investigations have involved
everything from revealing insider threats to serving as an expert witness in civil litigation andproviding the evidence to put cyber criminals behind bars. David has authored three series of books
on digital forensics; Hacking Exposed Computer Forensics (1st-3rd editions), Infosec Pro Guide toComputer Forensics, and the Anti Hacker Toolkit (Third Edition).

5

Patrick A. Westerhaus joined Wells Fargo in 2016 and is heading up a team in Enterprise Information
Security (EIS), Cyber Threat Fusion Center (CTFC), working to consolidate and analyze data in aneffort to develop an enterprise program to reduce cyber, fraud, and money laundering risk for the
institution. Prior to joining Wells Fargo, Patrick was with KPMG in their fraud and forensic practiceand he spent the last 12 years in the FBI reaching the level of Supervisory Special Agent in the
Headquarters Cyber Division. During his tenure in the FBI Patrick led investigations into corporate/
government fraud, public corruption, counterterrorism, counterintelligence, cyber fraud/theft andhis last position was at the NCIJTF’s Virtual Currency Team. Patrick has a Bachelor of Business
Administration in accounting from Gonzaga University, a Masters in Forensic Science in Security
Management from The George Washington University, and a graduate certificate in International
Security from Stanford. Patrick also is a CPA and he maintains CFE & CAMS certifications.
Chris Coulter is a forensic examiner and incident responder who has led engagements in government,
industry, and individual computer crimes investigations. He is a patent holder (Digital forensic
acquisition kit and methods of use thereof - United States US 13/019,796) for technology that hedeveloped and delivered to the market to simplify the complex methods of evidence acquisition inforensic computer investigations. His experience includes corporate leadership in cyber security
services and products, audit and investigations experience with PwC, Stroz Friedberg LLC, MIT
Labs, and the IRS.

SAMPLE

Eric Zimmerman is a senior director in Kroll’s Cyber Security and Investigations practice. Eric has atremendous depth and breadth of expertise in the cyber realm, spanning complex law enforcement
investigations, computer forensics, expert witness testimony, computer systems design and applicationarchitecture. He has received numerous recognitions for his work, is an award-winning author andis a frequently sought-after instructor and presenter on cyber-related topics. Before joining Kroll,
Eric was a Special Agent with the Federal Bureau of Investigation (FBI), specializing in investigating
criminal and national security-related computer intrusions, crimes against children (production,
distribution and possession of child pornography), intellectual property theft and related crimes.
Noriaki Hayashi is a Senior Researcher with Trend Micro Incorporated in Japan. He is a highly-skilled
and certified administrator and systems engineer in several computing platforms and technologies.
He has more than 17 years of systems management and security experience, including program andproject management, security research, and threat response.
Luke Dembosky is a Partner in Debevoise & Plimpton’s Cybersecurity & Data Privacy groupand formerly served as Deputy Assistant Attorney General for National Security at the JusticeDepartment’s National Security Division. Over 14 years with DOJ, he has served in various roles,
including as Deputy Chief for Litigation at DOJ’s Computer Crime and Intellectual Property
Section. Mr. Dembosky has been a regular advisor to the leadership of the DOJ, FBI, Secret Service,
National Security Council and other agencies regarding major cyber cases and related legal andpolicy issues. He participated in the negotiation of a 2013 cyber accord with Russia and the historic
5-point agreement signed by President Obama and President Xi Jinping of China in 2015, and hasco-represented DOJ in cyber discussions at the United Nations. He was recently named Vice Chair6

of the ABA Public Contract Law Section, focusing on addressing technology risks to supply chain.
Mr. Dembosky is also Co-Chair of the Information Sharing and Analysis Organization GovernanceWorking Group leading the development of internal governance guidance for ISAOs as part of theWhite House initiative to establish cybersecurity threat sharing platforms across industry.
John Jolly is the Vice President of Customer Success at Syncurity. Prior to joining Syncurity John
was the Vice President and General Manager of the Cyber Security Division at General Dynamics,
where he had responsibility for a broad portfolio of products and services that included a commercial
incident response practice.

John holds an undergraduate degree in Computer Science with honors

from the University of Maryland Baltimore County and a MBA in Finance with honors from theWharton School at the University of Pennsylvania.
Philip Fodchuk leads Suncor’s Enterprise wide Information Security Program. Within Suncor, Philip
is responsible for maturing and enhancing the information security posture of the organization, andleads the cyber security incident response function. Previously, Philip was a Partner with Deloitte’s
Cyber Security practice within the Enterprise Risk Services group. In that role he served as a
Global leader for Crisis Management for the Energy & Resources sector and was Deloitte’s Canadianleader for Cyber Security Incident Response. Philip was a sworn police officer with the Royal
Canadian Mounted Police (RCMP) and the Calgary Police Service where he worked with technological

SAMPLE

crime, cyber security and incident response matters. With 20 years of diverse experience, Philip isconsidered a subject matter expert in responding to, managing and developing strategies aroundcyber security, digital forensic, incident management and organizational crisis issues.
Ian (Iftach) Amit is a seasoned manager in the security and software industry with vast experience ina myriad areas of information security- from enterprise security, through retail, to end user softwareand large back-end systems. He is an Information Security expert with experience ranging from low
level technical expertise and up to corporate security policy, regulatory compliance and strategy. Ian
is a frequent BlackHat and DefCon speaker, and founding member of the PTES (Penetration Testing
Execution Standard), IL-CERT, and the Tel-Aviv DEFCON group (DC9723).

7

Reviewers
A special thanks to the following individuals who reviewed the draft edition of the CIBOK. Eachprovided important feedback to assist the authors. The list of contributors and reviewers will expand
over time as this CIBOK evolves.

Reviewers
Richard Nolan, Global Managing Director of Cyber Investigations, Citi
Nicholas Peach, Senior Vice President, Information Security Executive, Bank of America/Merrill
Lynch
Ronald Ritchey, Managing Director, JPMorgan Chase & Co.
Michael Woodson, VP, State Street
G. Bobby Singh, CISO, TMX Group
Avner Ziv, CIO, Bank of Israel
John R. Riley, Division Chief (Cyber Division), US Department of Homeland Security
Goran Oparnica, Managing Director, INsig2
Benoit Piton, CISO, BNP Paribas France
Dr. Richard Schroth, Executive Director and Executive in Residence, the Kogod Cybersecurity
Governance Center at American University

SAMPLEJohn Walton, Azure Security, Microsoft Corporation

Carmen Oveissi-Fields, Partner/Global CISO, Deloitte
Ron Gula, Founder Tenable Network Security

Michael J. Hershman, CEO, Fairfax Group / ICSSCIBOK Organizing Committee
The CIBOK was conceived and organized by the following individuals who contributed their talents
and efforts to produce this important work.
Executive Editor and Principal Author, Shane Shook
Executive Producer, Trend Micro Corporate Officer of Japan Region, Satoshi Shimizu
Executive Director, Proseed Corporation CEO, Hiroshi Nishino
Senior Coordinator, Trend Micro Incorporated Director, Masakazu YasumotoContributing Author and Project Member, Trend Micro Incorporated Senior Researcher, Noriaki
Hayashi
Style Editor and Project Controller, Trend Micro Incorporated Senior Specialist, Yuka Miyatake
Project Consultant, Proseed Corporation Senior Consultant, Tetsuri Sawada

8

CIBOK Table of Contents
Foreword.....................................................................................................................................................................3
Authors.........................................................................................................................................................................5
Reviewers...................................................................................................................................................................8

Introduction: Introduction to the Guide

19

Target Readers...................................................................................................................................................... 20
The Concept of“CIBOK”.................................................................................................................................... 21
What is the Reason for CIBOK?................................................................................................................. 21
Figure 1. Cybercrime Investigation Function........................................................................................................... 21

The Objective of“CIBOK”.................................................................................................................................. 22
What is the Objective of this Document?................................................................................................ 22
The Five Objectives of CIBOK Establishment........................................................................................ 22
Figure 2. Cybercrime Investigation Execution Framework................................................................................ 23
Table 1.“Related”Frameworks that Support“Practical Implementation”................................................... 24
Figure 3. Macro Framework of Cybercrime Investigative Divisions................................................................ 25

Cybercrime and its Investigation...................................................................................................................... 25
What is Cybercrime?...................................................................................................................................... 25

SAMPLE

Figure 4. b/d/r Dynamics............................................................................................................................................... 26
Table 2. Categories of Harmful Behaviors Occurring in Cyberspace............................................................ 26
Table 3. Categories of Damage to Victims Caused by Harmful Behaviors Occurring in Cyberspace......... 27
Table 4. Categories of Damage to Victims Caused by Harmful Behaviors Occurring in Cyberspace......... 27

What are Cybercrime Investigations?...................................................................................................... 27
Table 5. Categories of Investigation Activities....................................................................................................... 27
Table 6. Characteristics of Crime in Cyberspace.................................................................................................. 28

Strategy and Planning Based on Criminal Policy....................................................................................... 29
Framework for Value Creation................................................................................................................... 29
Figure 5. Adapting the Framework to Cybercrime Investigation Unit............................................................. 29

Composition of Cybercrime Investigative Divisions................................................................................... 31
Considerations of Cyber Divisions in the Structures of Traditional Investigation Organizations.......... 31
Figure 6. Structure of a Basic Traditional Crime Investigation Organization............................................... 31
Figure 7. Category-type Organizations...................................................................................................................... 32
Figure 8. Matrix-type Organizations........................................................................................................................... 33
Figure 9. Composite-type Organizations................................................................................................................... 33
Figure 10. Structural Diagram of a Cybercrime Investigation Unit.................................................................. 34

Management...................................................................................................................................................... 35
Intelligence......................................................................................................................................................... 35
Investigations.................................................................................................................................................... 36
Responders........................................................................................................................................................ 36
Digital Forensics............................................................................................................................................... 36
Judiciary............................................................................................................................................................. 36
Public Relations and Awareness................................................................................................................ 37
Support................................................................................................................................................................ 37
Administrative................................................................................................................................................... 37

9

Table 7. Corresponding Relationships between CI Execution Frameworks and CI Roles....................... 38
Table 8.  Association of CIBOK Taxonomy to CI Execution Framework....................................................... 38
Table 9.  CIBOK Taxonomy........................................................................................................................................... 39

Chapter 1: Cybercrime and its Investigation

41

Introduction.............................................................................................................................................................. 42
Topic Categories in Cybercrime its investigation....................................................................................... 42
Figure 1-1. Topic Categories in the“Cybercrime its investigation”knowledge domain.......................... 42

Defining Cybercrime............................................................................................................................................. 43
Technology as a Tool of the Crime........................................................................................................... 43
Technology as a Target of the Crime....................................................................................................... 45
Technology as a Distraction from the Crime......................................................................................... 46
Laws Defining Computer Crimes................................................................................................................ 47
Jurisdictional Issues Governing Cybercrime............................................................................................... 49
Convention on Cybercrime........................................................................................................................... 50
MLATs.................................................................................................................................................................. 51
Diplomacy........................................................................................................................................................... 51
Regulation.......................................................................................................................................................... 51
CERTs.................................................................................................................................................................. 52
Figure 1-2.  Cybercrime Governance......................................................................................................................... 52

SAMPLEBest Practices for Investigating Cybercrime............................................................................................... 53
A Multi-Faceted Approach............................................................................................................................ 54
Internal Protocols............................................................................................................................................ 54
External Resources........................................................................................................................................ 55
Chapter 1:  Association to the CIBOK Taxonomy...................................................................................... 55
Figure 1-3.  Cybercrime Investigative Execution Framework........................................................................... 56
Table 1-1.  CIBOK Taxonomy....................................................................................................................................... 57
Table 1-2.  CI Execution Framework association to CIBOK Taxonomy......................................................... 57

Chapter 1:  Review............................................................................................................................................... 59

Chapter 2: Types of Cybercrimes

61

Introduction.............................................................................................................................................................. 62
Topic Categories in Types of Cybercrimes.................................................................................................. 63
Figure 2-1. Topic Categories in the“Types of Cybercrimes”knowledge domain...................................... 63

What is Cybercrime?............................................................................................................................................ 63
Figure 2-2. Traditional and Cybercrime counterparts (Source GAO 2007) ................................................ 64

Technology as a Tool..................................................................................................................................... 65
Table 2-1.  The“Top 10 Financial Scams Targeting Seniors”include the following:............................... 67

Technology as a Target................................................................................................................................ 69
Technology as a Distraction........................................................................................................................ 74
Objectives and Motivations and Skills............................................................................................................ 75
Cyber fraudsters.............................................................................................................................................. 75
Cyber Bullies..................................................................................................................................................... 75
Hacktivists......................................................................................................................................................... 76
Sexual Exploitation of Children offenders............................................................................................... 76

10

Terrorism............................................................................................................................................................ 76
Computer hackers........................................................................................................................................... 76
APT Teams........................................................................................................................................................ 77
Chapter 2:  Association to the CIBOK Taxonomy...................................................................................... 78
Figure 2-3. Cybercrime Investigative Execution Framework............................................................................. 78
Table 2-2.  CIBOK Taxonomy....................................................................................................................................... 79
Table 2-3.  CI Execution Framework association to CIBOK Taxonomy......................................................... 79

Chapter 2:  Review............................................................................................................................................... 81

Chapter 3: Artifacts of Cybercrimes

83

Introduction.............................................................................................................................................................. 84
Topic Categories in Artifacts of Cybercrime............................................................................................... 84
Figure 3-1. Topic Categories in the“Artifacts of Cybercrimes”knowledge domain................................. 84

What are Indicators of Cybercrime?............................................................................................................... 85
Figure 3-2. Cyber“Kill Chain”Model.......................................................................................................................... 86
Figure 3-3. Cybercrime Indicators............................................................................................................................... 86

Attack.................................................................................................................................................................. 87
Reconnaissance............................................................................................................................................... 88
Compromise....................................................................................................................................................... 88
Exploitation/Success...................................................................................................................................... 88

SAMPLE

Stages of Cybercrime Activities....................................................................................................................... 89
Table 3-1. Cybercrime Activities................................................................................................................................. 89

Targeting............................................................................................................................................................ 89
Access Provisioning....................................................................................................................................... 89
Cataloguing........................................................................................................................................................ 90
Service Definition............................................................................................................................................ 90
Service Administration................................................................................................................................... 90
Service Support/Defense............................................................................................................................. 90
Redundancy of Services............................................................................................................................... 90
Obfuscation........................................................................................................................................................ 91
Alternate Services........................................................................................................................................... 91
Attainment of Objectives.............................................................................................................................. 91
Artifacts of Cybercrime....................................................................................................................................... 92
Figure 3-4. Association of Indicators to Artifacts.................................................................................................. 92

External Artifacts................................................................................................................................................... 93
The Internet....................................................................................................................................................... 93
Deep Web........................................................................................................................................................... 93
Dark Web............................................................................................................................................................ 93
Social Media...................................................................................................................................................... 94
Traditional Media............................................................................................................................................. 94
Figure 3-5.  External Artifacts of Cybercrime......................................................................................................... 94

Criminal Networks........................................................................................................................................... 94
Internal Artifacts.................................................................................................................................................... 95
Systems............................................................................................................................................................... 95
Personnel........................................................................................................................................................... 95

11

Communications............................................................................................................................................... 96
Figure 3-6. Internal Artifacts......................................................................................................................................... 96

Chapter 3:  Association to the CIBOK Taxonomy...................................................................................... 96
Figure 3-7. Cybercrime Investigative Execution Framework............................................................................. 97
Table 3-2. CIBOK Taxonomy......................................................................................................................................... 98
Table 3-3.  CI Execution Framework association to CIBOK Taxonomy......................................................... 98

Chapter 3:  Review............................................................................................................................................ 100

Chapter 4: Scope of Cybercrimes

101

Introduction........................................................................................................................................................... 102
Topic Categories in Scope of Cybercrime................................................................................................. 103
Figure 4-1. Topic Categories in the“Scope of Cybercrimes”knowledge domain.................................. 103

What is the Scope of Cybercrime?............................................................................................................... 104
Figure 4-2.  Scope of Cybercrime............................................................................................................................ 104
Figure 4-3.  Cyber Theft Ring.................................................................................................................................... 106
Figure 4-4. Darknet Offerings.................................................................................................................................... 108
Figure 4-5. Darknet Profiles....................................................................................................................................... 109

Nature of Cybercrime....................................................................................................................................... 109
Figure 4-6.  Nature of Cybercrime........................................................................................................................... 113

Incidental......................................................................................................................................................... 113

SAMPLE

Targeted.......................................................................................................................................................... 113
Evolved............................................................................................................................................................ 114
Cybercrime Risk Targeting............................................................................................................................. 115
Figure 4-7.  Cybercrime Motivation Trends.......................................................................................................... 116
Figure 4-8.  Trends in Techniques Employed in Cybercrimes........................................................................ 117
Tables 4-1.  Association of Traditional Crimes to Cybercrimes..................................................................... 118
Figure 4-9.  Association of Nature and Risks to Scope.................................................................................... 119

Financial........................................................................................................................................................... 119
Brand................................................................................................................................................................ 120
Operations....................................................................................................................................................... 120
Personnel........................................................................................................................................................ 121
Public vs. Private Organizations................................................................................................................... 121
Figure 4-10.  Comparison of Public and Private Organizations Risk Priorities........................................ 122

Chapter 4:  Association to the CIBOK Taxonomy................................................................................... 122
Figure 4-11. Cybercrime Investigative Execution Framework....................................................................... 123
Table 4-2. CIBOK Taxonomy...................................................................................................................................... 124
Table 4-3.  CI Execution Framework association to CIBOK Taxonomy...................................................... 124

Chapter 4:  Review............................................................................................................................................ 126

Chapter 5: Sources of Evidence

127

Introduction........................................................................................................................................................... 128
Topic Categories in Artifacts of Cybercrime............................................................................................ 128
Figure 5-1. Topic Categories in the“Sources of Evidence”knowledge domain..................................... 128

What are Sources of Evidence?.................................................................................................................... 129
Figure 5-2.  Association of Sources of Evidence................................................................................................ 129

12

External Sources of Evidence........................................................................................................................ 130
Figure 5-3.  Japan Cyber Control Center Model ............................................................................................... 130

Threat Intelligence....................................................................................................................................... 131
Forums and Message Boards................................................................................................................... 134
Botnet Control Panels................................................................................................................................. 134
Internal Sources of Evidence......................................................................................................................... 135
Figure 5-4.  Internal Sources of Evidence............................................................................................................. 135

Networks......................................................................................................................................................... 136
Hosts................................................................................................................................................................. 137
Services........................................................................................................................................................... 143
Figure 5-5.  Windows Event Log Contents............................................................................................................ 144

Chapter 5:  Association to the CIBOK Taxonomy................................................................................... 151
Figure 5-6. Cybercrime Investigative Execution Framework.......................................................................... 151
Table 5-1.  CIBOK Taxonomy.................................................................................................................................... 152
Table 5-2.  CI Execution Framework association to CIBOK Taxonomy...................................................... 152

Chapter 5:  Review............................................................................................................................................ 154

Chapter 6: Methods of Evidence Collection

155

Introduction........................................................................................................................................................... 156
Topic Categories in Artifacts of Cybercrime............................................................................................ 157

SAMPLE

Figure 6-1. Topic Categories in the“Sources of Evidence”knowledge domain..................................... 157

What are Methods of Evidence Collection?............................................................................................... 157
Figure 6-2.  Triage-based Evidence Collection.................................................................................................... 159

Automated Evidence Collection..................................................................................................................... 159
Systemic (alerts-based logging)............................................................................................................... 159
Figure 6-3.  IOC Example for Systemic Alerting.................................................................................................. 160
Figure 6-4.  STIX Architecture of an Alert............................................................................................................. 161
Figure 6-5.  Alerts-based Logging............................................................................................................................ 162“Sweep”discovery...................................................................................................................................... 162
Figure 6-6.  Phased Approach to Evidence Collection..................................................................................... 164
Figure 6-7.  Sweep Collection and Aggregation of Evidence......................................................................... 164

Manual Evidence Collection............................................................................................................................ 165
Figure 6-8.  Methods of Evidence Collection........................................................................................................ 166

Native Tools................................................................................................................................................... 167
Figure 6-9. TASKLIST use of PSAPI........................................................................................................................ 167
Figure 6-10.  Third-party use of PSAPI.................................................................................................................. 168
Figure 6-11.  Native NET statistics from Linux.................................................................................................... 168
Figure 6-12.  Third-party use of PS for NETSTAT.............................................................................................. 169
Figure 6-13.  Windows IPCONFIG and Linux ifconfig........................................................................................ 170
Figure 6-14.  Windows POWERSHELL Get-NetAdapter.................................................................................... 170
Figure 6-15.  Windows and Linux netstat -ano.................................................................................................... 171
Figure 6-16.  Windows TASKLIST /M and Linux ps -df..................................................................................... 171
Figure 6-17.  Windows NETSTAT -ANOB and Linux ss-ltp.............................................................................. 171
Figure 6-18.  Linux tcpdump...................................................................................................................................... 172
Figure 6-19.  Windows NETSH TRACE................................................................................................................... 172
Figure 6-20.  Microsoft Analyzer for NETSH TRACE........................................................................................ 173

13

Figure 6-21. Windows PowerShell Filesystem Metadata.................................................................................. 174
Figure 6-22. Linux lsw Metadata.............................................................................................................................. 174
Figure 6-23.  Windows ROBOCOPY and Linux dd.............................................................................................. 175
Figure 6-24.  Windows Events Viewer.................................................................................................................... 176
Figure 6-25.  Windows WEVTUTIL Query Utility................................................................................................. 176
Figure 6-26.  Windows TypedURL History............................................................................................................ 177
Figure 6-27.  Windows REGEDIT Export................................................................................................................ 177
Figure 6-28.  Windows PowerShell Examples .................................................................................................... 177
Figure 6-29.  PSRecon................................................................................................................................................. 178

Third-Party Tools.......................................................................................................................................... 179
Figure 6-30.  Investigator’s Collection................................................................................................................. 179
Figure 6-31.  NMAP....................................................................................................................................................... 180
Figure 6-32.  TCPView................................................................................................................................................. 180
Figure 6-33. Wireshark................................................................................................................................................. 181
Figure 6-34.  Autoruns and ProcExp....................................................................................................................... 182
Figure 6-35.  RawCopy and FGET............................................................................................................................ 182
Figure 6-36.  osTriage.................................................................................................................................................. 183
Figure 6-37.  Google Rapid Response.................................................................................................................... 184
Figure 6-38. Similarities between Forensic Review Tools............................................................................... 185
Figure 6-39.  Logging.................................................................................................................................................... 186

Forensic Integrity of Evidence....................................................................................................................... 187
Figure 6-40.  Forensic Integrity................................................................................................................................. 187

SAMPLE

Figure 6-41.  Windows and Linux Native Hashing.............................................................................................. 188

Procedure Documentation........................................................................................................................ 188
Tools Certification(s).................................................................................................................................... 189
Acquirer and Analyst Qualification(s).................................................................................................... 190
Requirements by Type of Cybercrime........................................................................................................ 190
By Target......................................................................................................................................................... 191
By Category................................................................................................................................................... 192
Table 6-1.  Evidence Collection by Category....................................................................................................... 192

Collection Guidance..................................................................................................................................... 193
Chain of Custody Maintenance................................................................................................................ 195
Table 6-2. Chain of Custody Log.............................................................................................................................. 196

Retention by Category/Jurisdiction....................................................................................................... 196
Destruction of Evidence............................................................................................................................. 196
Chapter 6:  Association to the CIBOK Taxonomy................................................................................... 197
Figure 6-42.  Cybercrime Investigative Execution Framework...................................................................... 197
Table 6-3.  CIBOK Taxonomy.................................................................................................................................... 198
Table 6-4.  CI Execution Framework association to CIBOK Taxonomy...................................................... 198

Chapter 6:  Review............................................................................................................................................ 200

Chapter 7: Methods of Evidence Analysis

201

Introduction........................................................................................................................................................... 202
Topic Categories in Methods of Evidence Analysis................................................................................ 203
Figure 7-1. Topic Categories in the“Methods of Evidence Analysis”knowledge domain................... 203

Aggregation.......................................................................................................................................................... 203

14

Collected Evidence...................................................................................................................................... 203
Threat Intelligence....................................................................................................................................... 204
Figure 7-2. The intelligence formation process................................................................................................... 204
Table 7-1. The reliability of information required by the phase..................................................................... 205

IOC..................................................................................................................................................................... 205
Table 7-2. Data elements to accumulate as IOC................................................................................................. 206
Table 7-3. Classification methods based on victim“culpability(culpabilité)”............................................ 207
Table 7-4. Program analysis methods..................................................................................................................... 210

Analysis Framework.......................................................................................................................................... 210
Data Modeling................................................................................................................................................ 211
Table 7-5. Merits of data modeling in police activities...................................................................................... 211
Table 7-6. Structured data and unstructured data............................................................................................ 211
Table 7-7. Types of metadata.................................................................................................................................... 212

Data Mining..................................................................................................................................................... 212
Table 7-8. Typical analysis models in data mining ............................................................................................ 212
Table 7-9. Tools used in data mining....................................................................................................................... 212

Extraction, Transformation, and Loading............................................................................................. 213
Data Quality Testing.................................................................................................................................... 215
Table 7-10. Checking methods for ascertaining integrity of data ............................................................... 215
Table 7–11. Examples of data types....................................................................................................................... 216
Table 7–12. Missing data structures....................................................................................................................... 216

SAMPLE

Table 7-13. Methods of deleting or complementing missing data................................................................. 217
Table 7-14. Approaches for detecting outlier data............................................................................................ 217

Automation...................................................................................................................................................... 217
Table 7-15. Database type......................................................................................................................................... 217
Table 7–16. Data mining software evaluation criteria developed by Ken Collier................................... 218

Quality Assurance and Control................................................................................................................ 218
Interpretation of Results................................................................................................................................... 219
Threat Profile................................................................................................................................................. 219
Table 7-17. Actor Classes ......................................................................................................................................... 220
Table 7-18. Actor Motivations................................................................................................................................... 220
Table 7-19. Actor Sophistication.............................................................................................................................. 220

Attribution Profiles....................................................................................................................................... 220
Table 7-20. Attribution Profiles................................................................................................................................. 221

Impact Analysis............................................................................................................................................. 221
Table 7-21. Impact Analysis....................................................................................................................................... 221

Chapter 7:  Association to the CIBOK Taxonomy................................................................................... 221
Figure 7-3.  Cybercrime Investigative Execution Framework........................................................................ 222
Table 7-22.  CIBOK Taxonomy.................................................................................................................................. 223
Table 7-23.  CI Execution Framework association to CIBOK Taxonomy................................................... 223

Chapter 7:  Review............................................................................................................................................ 225

Chapter 8: Resolution

227

Introduction........................................................................................................................................................... 228
Topic Categories in Resolution...................................................................................................................... 229
Figure 8-1. Topic Categories in the“Resolution”knowledge domain.......................................................... 229

15

What is Resolution?............................................................................................................................................ 229
Figure 8-2. Cybercrime Resolution Model.............................................................................................................. 230

Incident Investigation and Response Organization................................................................................. 230
Communications.................................................................................................................................................. 231
Figure 8-3.  Communicate to Resolve..................................................................................................................... 232

Internal............................................................................................................................................................. 232
Table 8-1. Internal Communications........................................................................................................................ 232

External............................................................................................................................................................ 232
Figure 8-4.  CIRT Information Sharing..................................................................................................................... 233
Table 8-2. External Communications....................................................................................................................... 235

Methods............................................................................................................................................................ 235
Figure 8-5.  Communications Plan............................................................................................................................ 236

Technical Remediation..................................................................................................................................... 237
Role Assignments......................................................................................................................................... 237
Table 8-3.  RACI Criteria.............................................................................................................................................. 237

Actions............................................................................................................................................................. 237
Table 8-4.  Technical Remediation Actions........................................................................................................... 238

Procedural Remediation................................................................................................................................... 241
Figure 8-6.  Procedural Remediation...................................................................................................................... 242

Investigate....................................................................................................................................................... 242
Table 8-5. U.S. Service Requirements on Email Collection............................................................................. 244

SAMPLE

Figure 8-7.  Cybercrime Environment..................................................................................................................... 245
Figure 8-8.  Organized Cybercrime.......................................................................................................................... 246
Figure 8-9.  Signatories of Treaty 185................................................................................................................... 247

Arrest................................................................................................................................................................ 248
Develop Intelligence.................................................................................................................................... 249
Prosecute........................................................................................................................................................ 250
Table 8-6.  Types of Witnesses................................................................................................................................. 251

Learn and Improve Detection/Prevention of Cybercrimes............................................................ 252
Figure 8-10.  Improving Resolution.......................................................................................................................... 252

Chapter 8:  Association to the CIBOK Taxonomy................................................................................... 253
Figure 8-11.  Cybercrime Investigative Execution Framework...................................................................... 253
Table 8-7. CIBOK Taxonomy...................................................................................................................................... 254
Table 8-8.  CI Execution Framework association to CIBOK Taxonomy...................................................... 254

Chapter 8:  Review............................................................................................................................................ 256

Chapter 9: Cybercrime Information Sharing

257

Introduction........................................................................................................................................................... 258
Topic Categories in Resolution...................................................................................................................... 259
Figure 9-1. Topic Categories in the“Cybercrime Information Sharing”knowledge domain................ 259

What is Cybercrime Information Sharing?.................................................................................................. 259
Framework............................................................................................................................................................ 260
Figure 9-2.  Cybercrime Information Sharing Framework................................................................................ 261

The Importance of a Solid Foundation:.................................................................................................. 261
Figure 9-3.  Case Management Framework.......................................................................................................... 262

The Next Layer - Developing a Community:........................................................................................ 262

16

Figure 9-4.  TAXII Sharing via AIS............................................................................................................................ 264

Legal Considerations......................................................................................................................................... 264
Jurisdiction:.................................................................................................................................................... 264
Type of crime:................................................................................................................................................ 265
Distribution/Dissemination............................................................................................................................... 266
Standards........................................................................................................................................................ 266
Figure 9-5.  Information Sharing Standards.......................................................................................................... 266

Governance:................................................................................................................................................... 267
Venues:............................................................................................................................................................ 269
Figure 9-6.  US Venues................................................................................................................................................ 269

Chapter 9:  Association to the CIBOK Taxonomy................................................................................... 270
Figure 9-7. Cybercrime Investigative Execution Framework.......................................................................... 270
Table 9-1. CIBOK Taxonomy...................................................................................................................................... 271
Table 9-2. CI Execution Framework association to CIBOK Taxonomy....................................................... 271

Chapter 9:  Review............................................................................................................................................ 273

Chapter 10: Management Framework

275

Introduction........................................................................................................................................................... 276
Topic Categories in Management Framework.......................................................................................... 277
Figure 10-1. Topic Categories in the“Management Framework”knowledge domain........................... 277

SAMPLE

What is the Cybercrime Investigations Management Framework?................................................... 277
Strategy and Governance............................................................................................................................... 278
Overall direction (e.g. vision, mission, or purpose)............................................................................ 278
Building Strategy.......................................................................................................................................... 279
Figure 10-2.  CI PDCA Process................................................................................................................................. 280
Figure 10-3.  CI OODA Process................................................................................................................................ 281
Figure 10-4.  Cyber Incident response activities and decisions.................................................................... 282

Planning........................................................................................................................................................... 284
Table 10-1. Planning for the CI function................................................................................................................ 284

Review Business Performance................................................................................................................ 284
Planning/Budgeting........................................................................................................................................... 285
Building Budgets Strategy......................................................................................................................... 285
Figure 10-5.  CI budget planning strategy............................................................................................................. 286

Risk Assessment........................................................................................................................................... 286
Risk Management ........................................................................................................................................ 288
Figure 10-6.  COBIT (5) Risk Management Process.......................................................................................... 288
Figure 10-7.  COBIT (5) Governance Processes................................................................................................ 289

Risk Mitigation................................................................................................................................................ 289
Table 10-2. Risk rating for mitigation...................................................................................................................... 290
Figure 10-8.  OWASP Risk Ranking......................................................................................................................... 291

Budget Planning............................................................................................................................................ 291
Budget Tracking........................................................................................................................................... 293
Resource Utilization Tracking.................................................................................................................. 293
Figure 10-9.  Simple budget tracking example.................................................................................................... 293

Budget Process Improvement.................................................................................................................. 294
Human Resources.............................................................................................................................................. 294

17

Defining Human Resources Organization............................................................................................ 294
Defining Jobs................................................................................................................................................. 294
Human Resource Utilization Planning................................................................................................... 295
Human Resource Performance Management..................................................................................... 295
Defining Skillsets........................................................................................................................................... 295
Figure 10-10.  Project GLACY skills association to the CI function............................................................. 296

Recruiting and Hiring.................................................................................................................................. 296
Table 10-3. Recruiting CI Targets by Activities................................................................................................... 296

Skills Performance Objectives................................................................................................................. 297
Skills and Knowledge Verification.......................................................................................................... 297
Performance Management.............................................................................................................................. 297
Organizational Performance Metrics..................................................................................................... 297
Organizational Auditing.............................................................................................................................. 297
Operational Process Metrics.................................................................................................................... 298
Operational Process Auditing.................................................................................................................. 298
Performance Measurement and Improvement................................................................................... 298
People Management.......................................................................................................................................... 298
Group Dynamics............................................................................................................................................ 298
Building Learning Organizations.............................................................................................................. 299
Coaching.......................................................................................................................................................... 299
Team Building................................................................................................................................................ 299

SAMPLE

Motivation Management............................................................................................................................. 300
Multi-cultural Environment Management.............................................................................................. 300
Tool Management............................................................................................................................................... 300
Tools Selection for Strategic Needs...................................................................................................... 300
Tools Selection for Tactical Needs........................................................................................................ 301
Tools Use Tracking and Performance Review.................................................................................. 301
Tools Training and Certification.............................................................................................................. 301
Chapter 10.  Association to the CIBOK Taxonomy................................................................................. 302
Figure 10-11.  Cybercrime Investigative Execution Framework................................................................... 302
Table 10-4.  CIBOK Taxonomy.................................................................................................................................. 303
Table 10-5.  CI Execution Framework association to CIBOK Taxonomy................................................... 303

Chapter 10:  Review.......................................................................................................................................... 305

Appendices

307

Key Terms and Definitions.............................................................................................................................. 308
Bibliography.......................................................................................................................................................... 310
Afterword.............................................................................................................................................................. 327
Index........................................................................................................................................................................ 318
Afterword.............................................................................................................................................................. 325

18

Introduction
Introduction to the Guide

SAMPLE

19

Target Readers
The following groups and individuals are considered to be the target readers of this document.

• Police organizations or law enforcement agencies (prosecutors, courts) conducting criminal
investigations, staff members of organizations conducting similar professional duties (organizations
with recognized police powers such as the right to investigate, the right to arrest, etc.), staff
members investigating organizational misdeeds, persons who have experience relating to criminal
investigations but who do not know what to do when confronted with the term“cybercrime”• Persons in charge of forming and commissioning new in-house cybercrime investigation teams• Executive trainees who have prior experience managing actual in-house criminal investigations,and who are expected to be appointed as persons responsible for cybercrime investigation
divisions in the future• Persons who conduct research/development/instruction in programs which train cybercrime
investigators and can exhibit a high level of effectiveness in a short period of time

SAMPLE
Cyber
Security

Cyber
Investigations

PDCA

OODA

Corporative
Objectives

Law Enforcement
Objectives

Same coin, diﬀerent focus

20

IntroThe Concept of“CIBOK”
What is the Reason for CIBOK?
Cyber security is a function of Information Technology (IT) to identify and mitigate risks to
the organization. The organization has operating risks and related control that are managed bypolicies, procedures, and training – and are supported by IT for information collection, processing,management, retention, and protection. IT also supports the risk management function of theorganization to mitigate risks to the continuity of the organization’s ability to serve customers(downstream) and to satisfy executive management in their obligations to satisfy the market,
shareholders, and partners.
As IT has evolved to support organizational requirements, related evolution in methods toleverage technology as a tool, to target IT used by a company, or to disrupt or distract organizational
functions through cyber means has coincidentally occurred. The Chief Information Officer (CIO) isa role that has gained a“seat at the boardroom table”for organizational strategy, and part of theirrole is to ensure the continuity of operations through IT support – including information protection
and infrastructure security. To support that role, the Chief Information Security Officer (CISO)
has been created for strategic and tactical planning and management of necessary resources. The
rapid advance of IT and correlated threats, however, has created requirements that particular

SAMPLEskills, knowledge and experience are needed to satisfy. Corresponding to those threats and related
requirements, market intelligence (open source and proprietary) has evolved that creates new risks
to the organization. In order to support the coincidental investigative and intelligence needs of theorganization, the Cybercrime Investigator role has emerged. CIBOK is intended to describe the needs,
background, and requirements to assist law enforcement and corporate risk managers, including IT.
Market/Shareholders/Partners

GC

CFO

CEO

COO

CIO

Requirements

Intelligence

Legislation
Law Enforcement
Regulators

CISO

Risk
Management

Finance

Administration

Logistics

Sales

Cybercrime
Investigator

Human
Resources

Operations

MIS

MarketingCustomer
SupportCustomers

Figure 1. Cybercrime Investigation Function

21

Open Source
Proprietary

The Objective of“CIBOK”
What is the Objective of this Document?
The objective of“Cybercrime Investigation Body of Knowledge: CIBOK”lies in demonstrating the“good practice”that capable and skillful cybercrime investigators implement in their investigation
activities.
This purpose is to demonstrate“taxonomy”- the systematic classification and organization ofentire areas regarding the knowledge, skills and approaches that must be commonly mastered in
the implementation of investigations of cybercrime - and thereby provide means of access to use
the topics included within. To this end, descriptions concerning each topic are limited to only thenecessary scope for the reader to successfully discover reference materials related to the topic. The
body of knowledge itself is not found within this document, but can be discovered from the referencematerial.

The Five Objectives of CIBOK Establishment
This document has been created in accordance with the following five objectives:

1. Popularizing and promoting a commonsense approach concerning consistent cybercrime

SAMPLE

investigations throughout the entire world, not dependent on the laws of each country.

2. Detailed demonstration of the positioning of other systematized customary practices,
project management, computer science and digital forensics within the scope of cybercrime
investigations.

3. Characterizing and demonstrating the content that should be put into practice in cybercrime
investigations.

4. Presenting means to utilize the topics concerning the body of knowledge of cybercrime
investigations.

5. To provide the basis necessary to prove that training curricula development and individual
knowledge and skills pertaining to duties are of a high level.
In order to achieve these objectives, the following activities are being carried out.
In order to achieve the first objective (knowledge concerning consistent worldwide cybercrime
investigations), this document has been created with the participation of 12 authors from 3 countries,
including reviews in its development process.
In order to achieve the second objective (detailed demonstration of positioning within the scope ofother systematized customary practices and cybercrime investigations), certain materials have been
deemed essential to include in cybercrime investigations as executable frameworks; these materials
are classified in accordance with the cybercrime investigations execution framework (which iscomposed of the eight knowledge areas exemplified in Figure 2).

22

Chapter

1

Cybercrime and its
Investigation

SAMPLE

41

Introduction
Crimes have always been a factor in society. Crimes are committed by humans for varied reasons,or to support associated purposes. The impact of a criminal act is interpreted by society to merit
reasonable penalties. Crimes are committed by humans, who utilize tools to facilitate their activities.
Cybercrimes are committed by humans who use computers for those purposes. Before businesses
were connected by networks or the Internet, intrusions were performed by using hammers, lockpicks, stolen badges or alarm system codes, or broken windows. Today’s business intruders use spearphishing emails, SQL injection attacks on web services, and social engineering techniques. The crimeis the same – breaking and entering, but the tools used to achieve that objective are different. At theend of the day, a crime is still committed by a person.
This chapter will explore the legal principles that relate to cybercrimes, how they are defined,
investigated, and prosecuted. It will also review issues of self-governance as well as jurisdictional
guidance (and constraints) that factor into the methods of investigation and prosecution. The roles
and responsibilities of organizational and investigating agencies will be described to help practitionersalign their programs and policies for an applicable framework.
Learning this knowledge domain will allow readers to acquire an understanding of the following.

SAMPLE• What do the courts and laws define as“cybercrime”?
• What jurisdictions govern cybercrime investigations?
• What are“best practices”for cybercrime investigations?

42

Chapter2

Types of Cybercrimes

SAMPLEIntroduction
Social outcry and demonstrations against injustices ascribed to businesses used to be the domain oforganized groups with picket signs in front of a business. Today such social outcry is performed withsocial media, or by defacing business marketing information such as websites. An associated objectiveof those demonstrations used to be impeding customer access to business products and services, or
slowing down workers’ ability to perform their jobs; today that is achieved through denial of service
attacks or sabotage through tools to wipe systems or make them unusable. Extortion used to be
performed with embarrassing information or control over access and services that a business relies
upon; today that is facilitated by ransomware. Espionage (commercial or government) has always
existed but is today facilitated by backdoor Trojans that enable remote access and eavesdropping.
What are the“types”of crime that cyber facilitates? This chapter will explore the evolution of
cybercrimes from how cyber tools were used to facilitate business interruption and antagonistic
brand attacks, to how cyber tools are being used to distract investigators from actual objectives thatcriminal actors are intent upon achieving – sometimes also with cyber tools. Associated descriptionsof such objectives and their supporting motivations, profiles of actors and victims, and identifying
characteristics of cybercriminals will also be provided.
The definitions provided in this chapter will assist organizational policy developers in determining
audit and assessment topics, as well as defensive and protective mechanisms by delineating the types

SAMPLEof threats that cybercrimes reflect.

Learning this knowledge domain will allow readers to acquire an understanding of the following.

• What is“cybercrime”?
• What are the objectives and motivations?
• What are the profiles of cyber-criminals?
• How are cyber-criminals organized?
• What skills and knowledge to cyber-criminals have?
• How has cybercrime evolved?

62

Chapter3

Artifacts of Cybercrimes

SAMPLE83

Introduction
Every crime leaves evidence behind. A crime is not a single act but a series of activities that
culminates in an illegal action. Consequently, traces and clues that reflect the planning, organization,
conduct, and commission of cybercrime are available if the Tools, Tactics, and Procedures (TTPs)
are understood by investigators and organizational managers. Whether committed as a random or aplanned act, those traces will help to distinguish the nature of the crime. Such traces are commonlyreferred to as“artifacts”.
This chapter will articulate the artifacts of cybercrime available to assess as evidence of the stageof activities, as indicators or attributes of the involved activities of the crime. Internal and externalsources of information to help investigators discover such artifacts will be described – to also assist
organizational policymakers and managers to build inclusive audit and assessment programs, ordefensive and protective systems and procedures.
At the conclusion of this chapter, readers will have understanding of:• What are the indicators of cybercrime?
• How do artifacts differ from indicators of cybercrime?
• What are the stages of cybercrime activities?
• What types of cybercrime artifacts are available to investigators?
• Where can investigators find cybercrime artifacts and indicators?

SAMPLE84

Chapter4

Scope of Cybercrimes

SAMPLE101

Introduction
A person is shot. That may or not be a crime depending upon the circumstances. The person isintentionally shot. It may still not be a crime. The person is not shot in a war, but in a community
area. The circumstances area still unclear. The person is intentionally shot in a crowd attending asocial demonstration. Perhaps the shooter had a legitimate reason such as self-defense? The person
who was shot was speaking to the crowd attending the social demonstration. There may be a crime
here. The person who was shot was Martin Luther King. Any crime is defined by the actions,
intent, and impact that relate to the act. The nature of the crime is defined by the same criteria;
the differentiator is fundamentally the“scope”of the crime. A crime such as described above isdifferent if the person who was shot was a soldier in a war, or even a bystander to a demonstration,versus MLK. This is simply because the impact of the criminal act has a broader scope. The threat,or consequences if the crime has already been committed, differ according to the objective(s) and themethods of achieving them.
Another scenario may be useful to describe more common cybercrimes. A security system alerts
a service that a building has been accessed without appropriate codes. Police respond and discoveran open door. Further examination shows a broken pane of glass that allowed the door to be opened
from within. Police discover a homeless person sleeping just inside the building. The same scenario,
but this time police also notice lights on in an office down the hall from the homeless person. A

SAMPLE

computer is turned on (odd because all others are off), and a folder on the computer desktop is opened
to a file called“Mergers 2016”with a“Copy Complete”dialog box on the screen. Upon questioning,
police learn from the homeless person that the door was already open when he came in from the cold
for a safe place to sleep.

As sensational as these crimes sound, they are unfortunately representative of types of crimes
facilitated by cyber tools, tactics, and procedures (TTPs). Murder, societal subversion, trespass,intellectual property theft, and extortion are all types of crimes facilitated by cyber – but their impact
is ultimately a deciding factor according to the scope of the crime in its commission and results.
A random computer infection that results in an attempted botnet subscription to a service thatis no longer available differs entirely from a targeted computer infection that spreads to corporate
computers to enlist botnet drones that enable a cybercriminal to steal information, eavesdrop upon
corporate performance data, and sell access to corporate systems – to subscribers of their botnet. A
computer intrusion to enlist a computer into a botnet also differs from a rogue trader who subscribes
to a botnet for purposes of insider trading with non-public information they gain access to thereby.
This chapter will explore the concept of“scope”in understanding and assessing cybercrime. The
nature of the crime, its purposes of targeting (to achieve designed objectives that the TTPs facilitate),and differences between public and private organizations will be described. This chapter will help anorganization define governance criteria for directing investigations, and developing associated policies,
systems, and procedures for defense and protection.

102

At the conclusion of this chapter, readers will have understanding of:• What are the different“natures”of cybercrimes?
• What organizational functions do cybercrimes target?
• How do risks to those functions differ in public versus private organizations?

4

SAMPLE103

Chapter5

Sources of Evidence

SAMPLE127

Introduction
Chapter 3 explored the artifacts of cybercrime according to the indicators associated with stages
and TTP’s of cybercrime activities. As discussed, every crime leaves evidence behind. Some evidence
is available in public sources because cybercrimes are often committed with shared services on theInternet, or are distributed actions (either for-hire or by organized criminal groups), or are repeatedin different forms – revealing such TTP’s to investigators and analysts who share related information.
Other evidence is solely available from internal (victim) sources such as systems, personnel, andassociated activity logs.
This chapter will examine the external and internal sources of evidence available to investigators tounderstand the scope, impact, and actions of cybercrimes. This information will help organizational
policymakers and managers develop audit and assessment criteria to define associated policies,
systems, and procedures for defense and protection.
At the conclusion of this chapter, readers will have understanding of:• What sources of evidence exist to identify cybercrime?
• Where can such evidence be found externally and internally to an organization?
• How do evidence sources differ in content, reliability, and structure?

SAMPLE

128

Chapter

6

Methods ofEvidence Collection

SAMPLE155

Introduction
How an investigator collects evidence from source is as or even sometimes more important than thecrime that a suspect is charged with. Many examples are available of prosecutions that have failed
due to improper evidence collection or handling; similarly, there are many examples of associatedcriminal charges being sought based upon previously collected evidence. The nature, scope, andTTP’s of cybercrimes will determine what types of evidence (and from which sources) are available.
This chapter will examine automated and manual methods of evidence collection according to
the nature, scope, and TTP’s of the relative types of cybercrime. Specific differences related torequirements by type of cybercrime will be reviewed as a cybercrime may relate later to othercrimes, or may have jurisdictional requirements according to the scope and impact of the crime.
Crimes against humans differ from business interruption or intellectual property theft, for example;
thus such differences will be explored.
This chapter will provide investigators with a reference framework for developing effective methodsof evidence collection according to such requirements. This will also assist organizational managers
to define associated policies, systems, and procedures for defense and protection.
This chapter includes methods of evidence collection from computers for analysis to be performedby qualified investigators. Several methods and tools are described, but it is not an“incident
response”guide. The focus of the chapter is to assist with the collection of artifacts from sources of

SAMPLEevidence previously discussed. The topics of cyber security and cybercrime investigations are related
but this chapter should help readers understand a practical difference between IT activities andinvestigations – evidence collection.

At the conclusion of this chapter, readers will have understanding of:• How can evidence of cybercrime be collected?
• How should evidence be collected?
• What measures or steps should be taken to ensure reliability of evidence?
• How do evidence and related methods differ by type of cybercrime?

156

Chapter

7

Methods ofEvidence Analysis

SAMPLE

201

Introduction
In the“Methods of Evidence Analysis”knowledge domain, cybercrime investigators never treat
evidence as coincidence – evidence is aggregated and analyzed through specific examination methods.
Cybercrime investigations require analysis controls based on data science. These controls must be
defined as essential elements in effective evidence analysis frameworks and include testing, quality
assurance, and disclosure of results.
Through this knowledge domain, cybercrime investigators can dissociate and consider cybercrimeby scope, stage, and type in order to identify risks and threats related to the organization. It
also includes profiles of, for example,“threat actors”(cyber criminals who give rise to threats toenterprises and organizations), and impact analysis regarding the“activities”that they perform.
This knowledge domain provides cybercrime investigators with essential fundamental frameworks
for developing effective methods of evidence analysis.
These frameworks also help managers to define“policies,”“systems,”and“procedures”related toprevention and protection.
This knowledge domain is divided into three topics, which are closely related to“Sources of
Evidence”(Chapter 5) and“Methods of Evidence Collection”(Chapter 6).
Just as the collection of appropriate evidence from the available sources is important for cybercrime
investigators, evidence analysis is important for evaluating the scope of the cybercrime.

SAMPLEIn general, investigations have constraints. Therefore, technology and other resources should beallocated in accordance with the evaluated scope.

At this time, efficiency and effectiveness in evidence analysis become the difference between carryingout appropriate cybercrime investigations and future enemies to prevent, or the difference between
suffering from similar (or worsening) cybercrime and the preparation of future-oriented cybercrime
prevention equipment.
The points above illustrate that this knowledge domain is related to all other aspects in cybercrime
investigations, and is linked to all other cybercrime investigation knowledge domains in this document.
Learning this knowledge domain will allow readers to acquire an understanding of the following.

• How should evidence be aggregated and analyzed for the purpose of cybercrime evidence
analysis?

• How should efficient data management and analysis frameworks be defined?
• How should analysis results be recorded and associated with the scope of the cybercrime?
“activities,”and“threat actors”be interpreted?
• How should impact analyses related to“threats,”

202

Chapter

8

Resolution

SAMPLE227

Introduction
Understanding what makes for an effective response to a cybercrime means asking not only“how”
an incident is resolved, but also“who”should be involved in the resolution and“when”they should
become involved. Resolution of cybercrimes involves organizational efforts to assess, investigate,
understand, and remediate – both technically and procedurally. An effective resolution is not simply
a matter of replacing a hacked system. It starts well before an incident occurs, with an assessment of
which information assets the organization has to protect, what risks it faces that shape how it should
invest time and resources to defend itself, and what planning and testing is necessary to improve theorganization’s posture to prevent, or respond to, cybercrimes. Thereafter it includes the activities inthe“normal course of business”that should be defended through awareness and preventative andinvestigative means.
This chapter will describe the roles, assignments, actions, and procedures used to investigate
and respond to cybercrimes. It will also explain how the scope, artifacts, sources, and evidence ofcybercrimes relate to the process of resolving the incident according to organizational or jurisdictional
policies. Because different cybercrimes differ in their impact, so too will they require different
investigative and resolution techniques.
This chapter will provide investigators with a suggested framework for responding to a cyberincident and remediating vulnerabilities according to best practices and liability-related considerations

SAMPLE

found in many jurisdictions. This will also assist organizational managers in defining associatedpolicies, systems, and procedures for defense and protection.

It is important to note that the legal and regulatory implications of many of the issues and actions
discussed in this chapter vary by jurisdiction. The purpose of this chapter is not to provide legal
advice and should not be relied on as such; rather, it is intended to provide an overview of the legal
and practical considerations that one should take into account when applying the facts and locallyapplicable law to cyber incident response.
At the conclusion of this chapter, readers will have an understanding of:• How should a cybercrime investigation and resolution function be organized?
• What methods of communication, with what authority should be established for phases of cyber
investigations and resolution?

• Who should be involved in cybercrime investigation and resolution program functions; andwhen?

• What tools, personnel, and procedures should be aligned for resolution?

228

Chapter

9

Cybercrime Information
Sharing

SAMPLE

257

Introduction
When a cybercrime is committed evidence of the activity is typically left either intentionally (defacing
a web page, publishing confidential information) or inadvertently (an IP address that was logged bya sensor, a malware binary). When law enforcement or other investigators initially respond to thecrime the initial information that is available may be sparse, particularly if the attackers have usedsophisticated techniques in an attempt to cover their tracks or if the original activity began some timeago. By following an orderly incident response (IR) process, ensuring proper chain of custody, andusing the forensic and IR techniques discussed in the preceding chapters, additional information andevidence will be generated. Such data may include details of the tactics, techniques and procedures(TTPs) used by the attackers as well as information that may be useful for attribution (identificationof the individual or group behind the crime) or for understanding or ascribing motive.
That evidence can be helpful to investigators to build experience for future cases and efficiencies
for analysis and prosecution; however, that evidence represents artifacts only the specific victim asa source. Because of today’s“sharing”economy of knowledge, skills, resources (even infrastructure)– and the organization(s) of cybercrime, it is unlikely that the artifacts discovered at a single victim
location will reveal enough about a cybercriminal to enable identification or effective prosecution. It
is for this primary reason that information sharing is so important in cybercrime investigations. Ifshared, such evidence can help organizations identify artifacts or indicators of early activities that

SAMPLE

if responded to can ward off subsequent crimes. Certain types of crime must necessarily limit thetypes of information that can be shared due to sensitivities of privacy or investigatory details that are
crucial to discovery of additional evidence for prosecution. In other words, not all information that
may be helpful, can be shared when it might actually be useful to interrupting cybercrimes.
This chapter will describe the methods and associated limitations of information sharing aboutcybercrimes. In particular it will illustrate the jurisdictional and classification limitations by typesof crime, and the authorities for release and sharing of related information. Guidance will also
be provided concerning documentation and qualification of information to be shared, as well as
the timeliness and purposes of sharing. This chapter will provide investigators with a reference
framework for sharing information according to such requirements. This will also assist organizational
managers to define associated policies, systems, and procedures for defense and protection.
At the conclusion of this chapter, readers will have understanding of:• Why should cybercrime information be shared?
• Who should share cybercrime information – internally and externally?
• What requirements govern which type of information to share, and when?
• In what venues and how should cybercrime information be shared?

258

Chapter

10

Management Framework

SAMPLE275

Introduction
Every organization, whether public or private, has limited resources to support functions andrelated procedures. Those resources must be managed for efficiency of scale and scope of application.
Incident response, investigation, and resolution of cybercrimes is a relatively new activity fororganizations that has not heretofore been organized as a common function (as compared to finance,
administration, information services, or customer support).
This chapter will articulate the structure and framework for constituting, planning, and executing
a management framework for the cyber investigations function. Just as information services have
expanded to support every organizational function, and management frameworks have evolved
procedures and tools - crimes committed with cyber tools or facilitated by cyber TTP’s are a new
dimension for organizations to investigate and defend against, and define associated procedures andtools. Descriptions of hierarchical and matrixed organizational structures will be associated to theactivities performed by the cyber investigations function and personnel.
This will also assist organizational managers to define associated policies, systems, and proceduresfor defense and protection.
At the conclusion of this chapter, readers will have understanding of:

SAMPLE• What is purpose of a cybercrime investigation and resolution function?
• How should the function be organized and managed?
• What is the strategic objective of that function?
• What are resource requirements (staff, tools, and community) of the function?
• What are the technical and experiential requirements to staff, manage, and lead/govern thatfunction?

• How should the function’s (and related staff) performance be measured?
• What organizational communications and strategic involvement, in which organizational channels,
should be implemented for success?

• Which organizational executive function(s) should the cybercrime investigations and resolutionfunction report to?

276

SAMPLE