Cybercrime Investigation Body of Knowledge

Training Courses
Header_2

Training for Skill/Knowledge development
for cybercrime investigation
This training is designed to master overview of knowledge, skill and technique for cybercrime investigation such as how to identify, respond, and investigate cybercrimes, which is required by law enforcement and corporate security officers and executives.

Who should take a course!
Law enforcement investigators and prosecutors, and corporate auditors and incident handlers whomay be tasked with related risk and compliance assessments and mitigation.

Training Course Objectives

Header_3•

Promoting a commonsense approach concerning consistent international cybercrime investigations, without dependency of laws of each country.

•

Detailed demonstration of the positioning of other systematized customary
practices, project management, computer science and digital forensics.

•To provide a framework for developing training curricula and individual knowledge
and skills pertaining to duties of investigators and responders.

•

Characterizing and demonstrating the content that should be put into practice incybercrime investigations.

•Presenting means to utilize the topics covered in this body of knowledge of cybercrime investigations collected from experienced professionals.

Training Level and Duration
Day 1
Executive
Training

Day 2

Day 3

Day 4

Overview

Fundamental
Training

Lecture and supporting
demonstrative exercises

Professional
Training

Technical analysis exerciseswith popular expert tools

Table-top exercise depicting
a real-world cybercrime

Knowledge Development

Skill Development

Footer_1

For more details: www.cibok.org
Contact: secretariat@cibok.org
Copyright © CIBOK Editorial Committee. All Rights Reserved.
All products or company names may be trademarks or registered trademarks of their owners.
The information in this document is as of July 2017. Information in this document is subject to change without notice.

Day 5

Cybercrime Investigation Body of Knowledge

Training Courses
Executive Training Course
Header_2

5 hours high level introduction for knowledge and skill

Introduction to CIBOK

PurposeCybercrime and its Investigation
Types of Cybercrimes

Methods of Evidence Collection

including Q&A session

LawsCrimSources of EvidenceHigh level introduction for the task with related risk andcompliance assessments and mitigation,

ProcessPeople

Methods of Evidence Analysis

Strategy

Incident ResolutionskRi

Scope of Cybercrime

eArtifacts of Cybercrime

TechnologyResponseTactics

Cybercrime Information Sharing
Management Framework

Fundamental Training Course
Day 1: Knowledge Development

Header_3

The 5 objectives of CIBOK
What is a Cybercrime?

• To include jurisdictional considerations andinformation sharing within international privacy
boundaries.

What are Cybercrime Investigations?
What are challenges to Cybercrime Investigations?
What skills, knowledge and experience are necessary to develop investigative capabilities?

Day 2: Skills Development
What is “evidence” vs. “artifacts” of cybercrime?
What are the sources of evidence?

• T he identification (and discretion) of crimes versus

What are the methods of evidence collection?

anomalous activities, and methods of evidence collection and handling – for analysis.

How should evidence be handled for investigative and judicial purposes?
What are methods of analysis for evidence of Cybercrimes?
What sources of information are available to intelligently discover or prevent Cybercrimes?
How should information about Cybercrimes be shared?

• Methods of efficient collection, processing andanalysis with popular expert tools.
• Limited technical demonstrations for discussion.

What are the minimum organizational requirements for a Cybercrimes investigation unit?
What tools and training are available to develop Cybercrimes investigation staff?

Professional Training Course
Day 1-2: Knowledge Development
The 5 objectives of CIBOK• R
 etail/POS Breaches

What is a Cybercrime?

••••

What are Cybercrime Investigations?
What are challenges to Cybercrime Investigations?
What skills, knowledge and experience are necessary to develop investigative capabilities?

 ech/Defense IP TheftTHealthcare/Gov Data TheftBank ATM/Payments Network TheftSocial networks/services identity theft and Fraud

Day 3-5: Skills Development
What is “evidence” vs. “artifacts” of cybercrime?
What are the sources of evidence?
What are the methods of evidence collection?
How should evidence be handled for investigative and judicial purposes?
What are methods of analysis for evidence of Cybercrimes?
What sources of information are available to intelligently discover or prevent Cybercrimes?
How should information about Cybercrimes be shared?
What are the minimum organizational requirements for a Cybercrimes investigation unit?
Footer_1

For more details: www.cibok.org
Contact: secretariat@cibok.org
Copyright © CIBOK Editorial Committee. All Rights Reserved.
All products or company names may be trademarks or registered trademarks of their owners.
The information in this document is as of July 2017. Information in this document is subject to change without notice.

• The identification (and discretion) of crimes versus
anomalous activities, and methods of evidencecollection and handling – for analysis.
• Methods of efficient collection, processing andanalysis with popular expert tools.
• Technical demonstrations, with associated exercises and samples.