Cybercrime investigators handbook / Graeme Edwards.

Includes index.

"This book provides the reader with the knowledge and investigative methodology on how to investigate cybercrime from a field practitioner's perspective. Cybercrime is aggressively targeting governments, businesses and individuals of all levels in increasing numbers, law enforcement can provide only limited support and civilian investigators have to take responsibility for investigating their own crimes. While there are very high-quality manuals for conducting digital examinations on a device or network that has been hacked, there is no known guide for those who want to use this information to commence an investigation from the location the offence occurred with the intention of location and prosecuting the attacker. That is, from the cybercrime scene. This book provides a valuable contribution to the actual practical ground level investigation including evidence location, lawful seizure, preservation, examination, interpretation and management. These are core duties which if not completed correctly, leads to poor quality and incomplete investigations. It is believed this handbook will sit alongside the other texts stated and fill the gap in the marketplace where the front-line investigator has limited guidance on how to react at the cybercrime scene whilst the offence is occurring. In addition, this book will also help those companies that are GDPR (General Data Protection Regulation, a European Union regulation that instituted new new rules governing the use and manipulation of personal data) follow a plan if their data is compromised"-- Provided by publisher.

Cover; Title Page; Copyright; Contents; List of Figures; About the Author; Foreword; Acknowledgments; Chapter 1 Introduction; Chapter 2 Cybercrime Offenses; Potential Cybercrime Offenses; Industrial Espionage; Theft of Information Such as Identities, Staff Files, and Accounts; Computer Hacking to Gain Access to System Resources; Gaining or Exceeding Authorized Access Levels to Obtain Highly Restricted Data; Exploiting Information Security Weaknesses through the Supply Chain, Including Third‐Party Contractors; Stealing Credit Card Data for Selling Online, or Card‐Not‐Present Fraud

Gaining Access to a System or Device through Malicious SoftwareDamaging the Reputation of a Competitor to Gain a Market Advantage; Changes to Computer Systems or Devices; Vandalism to Prove the Skills of the Attacker; Drive‐by Downloads of Malicious Software; Interfering with Access to a Network; Ransomware; Phishing Attacks and Money Laundering; Business Email Compromise Fraud; Social Engineering Fraud; Cybercrime Case Study; Notes; Chapter 3 Motivations of the Attacker; Common Motivators; Revenge; Opportunity; Greed; Test of Skill; Business Competitor; Professional Criminal

Issue‐Motivated AttackerGeopolitics; Terrorism; Cybercrime Case Study I; Cybercrime Case Study II; Note; Chapter 4 Determining That a Cybercrime Is Being Committed; Cyber Incident Alerts; Attack Methodologies; Cybercrime Case Study I; Cybercrime Case Study II; Notes; Chapter 5 Commencing a Cybercrime Investigation; Why Investigate a Cybercrime?; The Cyber Investigator; Management Support; Is There a Responsibility to Try to Get the Data Back?; Cybercrime Case Study; Notes; Chapter 6 Legal Considerations When Planning an Investigation; Role of the Law in a Digital Crimes Investigation

Protecting Digital EvidencePreservation of the Chain of Custody; Protection of Evidence; Legal Implications of Digital Evidence Collection; Cybercrime Case Study; Note; Chapter 7 Initial Meeting with the Complainant; Initial Discussion; Complainant Details; Event Details; Cyber Security History; Scene Details; Identifying Offenses; Identifying Witnesses; Identifying Suspects; Identifying the Modus Operandi of Attack; Evidence: Technical; Evidence: Other; Cybercrime Case Study; Chapter 8 Containing and Remediating the Cyber Security Incident; Containing the Cyber Security Incident

Eradicating the Cyber Security IncidentNote; Chapter 9 Challenges in Cyber Security Incident Investigations; Unique Challenges; Defining Investigation Boundaries and Management Objectives; Identifying Potential Offenses (Criminal and/or Civil); Identifying Compromised Data and/or Resources; Identifying Suspects and Motivations; Identifying Exploited Vulnerabilities; Securing Evidence; Understanding the Legal Jurisdiction Where the Incident Occurred and the Evidence Exists; Locating Digital Evidence in a Timely Manner; Maintaining the Chain of Evidence across Multiple Jurisdictions