- [Instructor] One of the key topics
in cybersecurity forensics is attribution of assets
and threat actors.
So again, not only attribution to who actually perform
the security incident or the attack,
but also what systems were involved, right?
So then you can do further attribution to the threat actor.
Now, there's definitely undeniable motivation
to support an evidence-led approach
to cybersecurity forensics to achieve good attribution.
Now, a suspect-led approach is actually often biased
to the disadvantage of those being investigated.
And this is due to the large number
of technical complexities, and it is often impractical
for cybersecurity forensics experts
to be able to determine fully the reliability of endpoints.
Also the reliability of servers
and networking infrastructure devices.
And subsequently actually to provide assurance
to the court or to the entity that is investigating
the issue about the actual soundness
of the processes involved
and complete attribution to a threat actor, right?
Now, the forensics expert needs to ensure that no parts
of the examination process were overlooked or repetitive.
Also cybersecurity forensic experts are often confronted
with the inefficacy of traditional security processes
in systems and networks designed to preserve documents
and network functionality.
Especially since most systems are not designed
to enhance digital evidence recovery.
Now, there's a need
for appropriate cybersecurity forensics tools,
including software imaging like we mentioned before,
and also the indexing of the large data sets
in order to successfully reconstruct an attack
and attribute such attack to an asset or to a threat actor.
Now, one thing to keep in mind is that traditional data
forensics tools are typically designed to obtain
the lowest hanging fruit
and encourage security professionals to actually look
for the evidence that is easier or the easiest evidence
to be identified and to be recovered.
Now, often these tools do not have the capabilities
to even recognize other less obvious evidence, right?
So that's the one of the considerations
that you actually have to keep in mind
when selecting a cyber forensics tool.
Now during the cybersecurity investigation,
the forensics expert may revisit portions of the evidence
to actually determine its validity, right?
Now, as a result, it may require additional investigations
and further investigation within your environment.
Now, this often can be a tedious process, right?
And in some cases, the complexity of the network
and the time required for the investigation
can affect the efficacy of the cybersecurity forensics
professional to actually reconstruct and also to provide
an accurate interpretation of that evidence.
Now, from a practical and a realistic perspective,
the amount of time and effort involving
digital forensic process should pass
the acceptable, reasonable test.
In other words, that all efforts should not be put
into finding every single conceivable trace of evidence
and analyzing it, right?
I mean, you're never gonna be able to actually do that,
and you will never be able to scale.
And this is especially becoming more challenging
to the cybersecurity forensics expert as the volume of data
to be analyzed becomes extremely big, right?
Nowadays with big data and big data analytics,
this is actually a challenge.
Now, evidence in cybersecurity investigations
that go to court is used to prove or disprove facts
that are in dispute.
And of course, as well as approving the credibility
of the disputed facts, right?
So in particular circumstantial evidence
or indirect evidence is one of the facts
that comes into play, right?
Now, digital forensics evidence provides implications
and extrapolations that may assist
in providing some key facts to that case, right?
And that evidence helps the legal teams and the courts
to develop reliable hypothesis or theories
to the committer of the crime or the threat actor, right?
Now, the reliability of the evidence is vital and is crucial
to supporting or refuting any type of hypothesis put forward
during the attribution of a threat actor, right?
So these are really important things
that I'm, of course, repeating through the course
because are crucial for evidence collection,
evidence preservation, and for you to be able
to be successful in front of a court, right?
And in front of a judge.