Hacker Wanted – Why IT Forensics is Important

Hacker Wanted – Connection with IT Forensics

Everyone knows forensics from criminalistics as a meticulous, expert examination of the crime scene and the victim after a crime has taken place. The aim is to identify perpetrators on the basis of the smallest traces and to create a complete chain of evidence that will stand up in court. In this way, wanted blackhat hackers can be found.

IT forensics, also known as digital forensics or cyber forensics, is ultimately about nothing else. It is used to uncover criminality with a focus on IT, but also to analyse and clarify faults or malfunctions in IT infrastructures. A compromised IT system is examined in detail after a security incident in order to secure evidence that can be used in court. The aim of an IT forensic investigation is to find the answer to when, where, which and how (personal) information could have been manipulated. To this end, all digital traces – such as downloads, software programmes used, file accesses and deletions carried out, as well as browser usage – are secured by the IT forensic experts. A detailed, methodical analysis procedure is then applied to the collected data in order to find usable evidence of criminal offences and to be able to clearly assign them to the person(s) responsible. Due to the continuous increase in cybercrime, IT forensics will become increasingly important in the future in order to put a stop to criminal blackhat hackers who use the Internet as a weapon.

The methods used to analyse IT forensics can also be transferred to mobile devices such as laptops, tablets or smartphones. They help in the subsequent investigation of a breach of IT security requirements or to track down possible criminal offences from mobile devices.

Relevance of IT Forensics to Uncover Wanted Hackers

The connection between the wanted hacker and IT forensics therefore lies in the usability of evidence in court. While IT forensics collects, analyses, secures and processes digital traces of IT security incidents for use in court, companies accused of violating the EU GDPR need this very evidence in order to be able to defend themselves in a possible court hearing. Digital traces of wanted hackers should prove that the company has consistently complied with all necessary obligations to protect personal data within the meaning of the EU GDPR. Only evidence that can be used in court can be used as proof of the proper handling of personal data. If this evidence is available, companies can avoid a conviction and thus a fine.

If a company falls victim to a hacking or phishing attack in which personal data of customers, partners or employees is stolen, it must still fulfil the requirements of the EU GDPR. According to Article 33(1) GDPR, this means that companies must report all security breaches affecting personal data to the data protection authorities and the data subjects without delay, but no later than 72 hours. They are also subject to strict documentation requirements. Companies must be able to provide complete proof that they were able to ensure the protection of personal data on a permanent basis. If this deadline expires without corresponding notification, fines will be imposed.

Answers to the following questions must be provided in the notification to the competent data protection authorities:

• How many people are affected and what personal data has been stolen or misused?
• What is the cause and what was the intention behind the attack?
• How did the attackers gain access and where did it originate?
• Can the realistic risk for those affected be estimated?

This is probably where the most important change in the EU GDPR comes into play – the shift in the burden of proof from the injured party to the company. Under the old Federal Data Protection Act (BDSG-old), the injured party bore the burden of proof for a breach of data protection law. This now lies with the accused companies and public bodies. Under the current EU GDPR, they must be able to prove at any time that they have done everything possible to ensure the security of the personal data of customers, partners or employees.

In order to fulfil this burden of proof – and thus prove third-party culpability for which they cannot be held liable – the named digital traces of an attack must be verifiable. If charges are brought due to a possible data protection breach, it must be possible to prove evidence that can be used in court in order to confirm innocence.

A guide to IT forensics from the Federal Ministry for Information Security (BSI) can be found here: BSI IT forensics guide.

Hacker Wanted by ‘Forensic Readiness’ to be Better Prepared

The activity of cybercrime by wanted hackers and data misuse – both from outside, but increasingly also within an organisation – will increase. Even the best measures to prevent IT security incidents, such as increasing security investments and modernising IT security, are not infallible. There will never be 100% security. Time and again, wanted hackers will find ways and means to attack a company’s IT infrastructure, manipulate information or misuse it.

Organisations – especially companies that handle a lot of sensitive personal data or have already been the victim of an IT security incident – should develop new security measures and strategies or optimise existing measures. The aim must be to be able to react and act quickly in the event of an IT security incident. Forensic readiness is the ability of a company to utilise the potential of digital evidence to reduce the costs of an investigation. It plays a preventative role in protecting the company against attacks on the IT infrastructure, for example through classic hacking, but also through the carelessness of employees or sabotage. Such IT security incidents can lead to legal disputes or claims against insurance companies, for which evidence must be provided. An article on a recent incident involving blackmail software can be found here: Blackmail software spreads fear and terror

The implementation of ‘forensic readiness’ in the company takes place in two stages and should always be carried out by a specialist due to the intensive analysis activities. The process is outlined in more detail in a short list:

Phase 1 – Preparation of the as-is analysis

Initially, it is necessary to comprehensively analyse the IT landscape. The focus is on implemented guidelines and processes for dealing with IT security breaches. The aim is to analyse the technical and organisational structures within the company and to estimate how quickly a response to security-related incidents could take place.

Phase 2 – Optimisation of procedures and processes

Potential for optimisation is sought on the basis of the data and processes identified. The aim is to develop an effective and customised action plan. The aim is to optimise the existing measures and supplement them in a meaningful way. This includes both technical and organisational guidelines, checklists and specifications. They define how to react in the event of an IT security incident so that the right steps can be taken quickly. It makes sense to sensitise employees in the event of an emergency.

Companies that use processes to ensure forensic readiness usually succeed in reducing the number of IT security incidents. They are optimally prepared for attacks and can optimise their action plan to such an extent that they are able to react better, faster and more accurately in an emergency. In this way, IT security and IT forensics go hand in hand.

Conclusion: Hackers Sought and Uncovered Through IT Forensics

A blackhat hacker who has hacked into a company is often sought after. Whitehat hackers can be commissioned as a solution against hacker attacks. These hackers have the knowledge to close security gaps. Hackers are often used in IT forensics to be better prepared for hacker attacks.