7-2 Project Two Submission: Digital Discovery Summary

Digital Discovery Summary

Overview

This course introduces the foundations of digital forensics. An understanding of digital forensics is a great addition to the skill set of a cybersecurity analyst. It draws upon the adversarial mindset that you have been developing throughout the program. The more you anticipate how a threat actor circumvents controls, the better you will be at gathering information to support digital forensics investigations. This project will build your problem-solving skills as you consider the process, approach, and potential tools of such investigations.

Remember that these investigations can be costly in terms of time and resources and are not initiated lightly. There is usually a very specific incident that triggers a digital investigation. Most commonly within organizations, Human Resources (HR) is involved because the rights of the employee need to be respected and protected. IT departments normally need approval from HR to be able to perform any digital forensics activities. In more serious investigations, lawyers and law enforcement follow procedures related to chain of custody. Maintaining chain of custody can be a vital component of these investigations.

A final piece to consider is that digital investigations are not just a virtual experience! Tangible media storage is also an aspect of these investigations, which includes any device that can be used for storage. Similarly, physical locations are also a necessary consideration for these investigations: for example, a password on a sticky note underneath a keyboard, or items in a desk drawer.

The project incorporates one stepping stone, which will be submitted in Module Five. The project will be submitted in Module Seven.

In this assignment, you will demonstrate your mastery of the following competency:

• Describe fundamentals of digital investigations

Scenario

The HR department at Ocwen has received notice that an employee may have been involved in activities that could be considered in violation of Ocwen’s acceptable use policy (AuP). The AuP articulates the expectations and behaviors of employees using computing assets within Ocwen. The notice to HR is being investigated because of its accusation of misconduct by a high-level executive of Ocwen. The potential for damaged brand reputation is also of utmost importance to Ocwen and its partners.

The accusation states that the executive used Ocwen computing assets to conduct side business operations and to run personal ads on a dating website. Three months ago, anomalous network activity was noticed by the IT security team. Problems for Ocwen were further complicated when a cybersecurity incident required restoring certain affected information systems from backup. It is alleged that the most recent cybersecurity incident experienced by Ocwen was directly related to this unauthorized activity.

As a cybersecurity analyst at Ocwen, you have been tasked by the IT manager to gather information as part of HR’s investigation.

Prompt

You must address the critical elements listed below. The codes shown in brackets indicate the competency to which each critical element is aligned.

1. Digital Discovery Summary
   1. Evaluate whether or not the scenario breaches the acceptable use policy. Justify your response.
   2. Applying a systematic approach, where could you look for potential evidence? Identify at least three locations and describe what type of information you would find there.
   3. What procedures would you use to maintain chain of custody?
   4. Based on your research, what forensic tools would you recommend to complete this investigation? Include one software forensic tool and one hardware forensic tool. Justify your response.

What to Submit

Your submission should be 2 to 3 pages in length. Use double spacing, 12-point Times New Roman font, and one-inch margins. Any references should be cited according to APA style. Use a file name that includes the course code, the assignment title, and your name—for example, CYB_123_Assignment_Firstname_Lastname.docx.

Project Two Rubric

Criteria	Exemplary (100%)	Proficient (85%)	Needs Improvement (55%)	Not Evident (0%)	Value
Digital Discovery Summary: Acceptable Use Policy	Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner	Evaluates whether or not the scenario breaches the acceptable use policy and justifies response	Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail	Does not address critical element, or response is irrelevant	22.5
Digital Discovery Summary: Potential Evidence	Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner	Identifies at least three locations to look for potential evidence and describes what type of information could be found there	Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail	Does not address critical element, or response is irrelevant	22.5
Digital Discovery Summary: Chain of Custody	Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner	Describes the procedures to maintain chain of custody	Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail	Does not address critical element, or response is irrelevant	22.5
Digital Discovery Summary: Forensic Tools	Meets “Proficient” criteria and addresses critical element in an exceptionally clear, insightful, sophisticated, or creative manner	Recommends one software forensic tool and one hardware forensic tool to complete the investigation and justifies response	Addresses “Proficient” criteria, but there are gaps in clarity, logic, or detail	Does not address critical element, or response is irrelevant	22.5
Articulation of Response	Submission is free of errors related to citations, grammar, spelling, and organization and is presented in a professional and easy-to-read format	Submission has no major errors related to citations, grammar, spelling, or organization	Submission has some errors related to citations, grammar, spelling, or organization that negatively impact readability and articulation of main ideas	Submission has critical errors related to citations, grammar, spelling, or organization that prevent understanding of ideas	10
Total:					100%