Ict forensics and audit bb
- 1. 1 1 Towards a Secure Digital Future - Zimbabwe , June 2015 Dr W Ruakanda wr@mornipac.co.za This report is solely for the use at CSZ presentation. No part of it may be circulated, quoted, or reproduced for distribution outside the client organization without prior written approval from MorniPac Consultants This material was used by MorniPac Consultants during an oral presentation; it is not a complete record of the discussion. Computer Society of Zimbabwe Business School ICT Forensics A Brief Introduction (VoWiFi) please feel free to add your input and comments
- 3. Wednesday, 21 January 2015 Voice over WiFi (VoWiFi) technical details VoWiFi is certainly a hot topic, thanks to the support of VoWiFi on iPhone 6. A presentation from LTE World Summit 2014 by Taqua on this topic has already crossed 13K views
- 24. BLUE COAT SYSTEMS MOBILE MALWARE REPORT: A NEW LOOK AT OLD THREATS The explosion of mobile devices means there are now 1.5 billion new ways to steal data, passwords, or money. This has replaced pornography as the leading mobile threat. There are fresh insights into other new tricks cybercriminals have perpetrated as well as learn more about: Today’s most prolific mobile threats The stages of a mobile attack How user behavior drives mobile threats What directs users to mobile malware Best practices for avoiding trouble Copyright ® 2015, Blue Coat Systems, Inc. All Rights Reserved
- 25. The cost of cyber crime for the global economy has been estimated at $445 billion (£266 billion) annually. Cyber espionage and stealing individuals' personal information is believed to have affected more than 800 million people during 2013. Financial losses from cybertheft could cause as many as 150,000 Europeans to lose their jobs, according to a report conducted by internet security company McAfee. Cyber crime damages trade between nations, competitiveness, innovation, and global economic growth, and slows the pace of global innovation. McAfee is calling for governments to begin a serious, systematic effort to collect and publish data on cybercrime to help countries and companies make better choices about risk and policy. By Rhiannon Williams : 2:44PM BST 09 Jun 2014
- 26. Studies estimate that the internet economy annually generates between $2 trillion and $3 trillion, a share of the global economy that is expected to grow rapidly. Based on Center for Strategic and International Studies (CSIS) analysis, cybercrime extracts between 15 per cent and 20 per cent of the value created by the internet. Despite one London-based business losing $1.3 billion (£800 million) in a single malicious attack during 2012, the majority of cyber criminals still have substantial difficulty in monetising their stolen data. The total cost of cyber crime to the UK economy alone was $11.4 billion during 2013, the equivalent to 0.16 per cent of the GDP. Retailers lost more than $850 million during the same period as a result of penalty free financial crime. The figures do not come as a surprise to security professionals and big businesses, said Mark Sparshott, EMEA director of security firm Proofpoint. He said the attraction of cybercrime to many criminals was due to its relatively low level of risk. "The volumes of attacks are increasing because it is a profitable business model for organised crime," he said. " With cyber crime there is no risky getaway because the attack is routed through hundreds or thousands of PCs in dozens of countries, making it almost impossible to trace. The internet makes most attacks anonymous and untraceable and that is really attractive to cybercriminals.” Raj Samani, EMEA Chief Technology Officer for McAfee, agreed. “It is clear that cyber crime has a real and detrimental impact on the global economy. Over time, cyber crime has become a growth industry; the returns are great, and the risks are low,” he said. "As more businesses move online and more consumers connect to the internet, the opportunities for cybercrime will only grow, making it imperative that countries work together now to proactively tackle cyber crime.”
- 27. Telegraph Technology Is this what the iPhone 6s or 7 will look like?: in pictures 2:32PM BST 04 Jun 2014 America and China have spent the past few years in a stand-off over Chinese attitudes to intellectual property, and how the Chinese government goes about cyber-spying. Virtually all nations engage in cyber-spying to some degree, but experts suspect China of using the material to give Chinese companies an unfair advantage over their foreign rivals. However, Chinese businesses insist they act independently of the government, and have accused America of having a protectionist agenda. Huawei said it has been frozen out of US contracts because of “jealousy”. The US government has issued a number of reports claiming that Chinese companies posed a security risk. Senators on the cyber security council have also cautioned American businesses to blacklist Huawei and ZTE, another technology firm, unless they got the all-clear from a US government agency. Source: Bloomberg
- 28. …….also your biggest liability. Unfortunately, computer information is often not adequately protected and computer- related crime is rapidly growing. The ability to discover and investigate the misuse or theft of sensitive information is becoming increasingly important if the information you store electronically is to remain intact and, more importantly, within your control.
- 29. Forensic Focus UK cyber crime costs +£37bn a year Oxygen Software Focuses on Smart Phone Forensics with Oxygen Forensic Suite 2011 Digital Forensic Investigations: Just how good are they? Nigeria: Expert Canvasses Forensic Protection of Votes How to perform a forensic PC investigation (with OSForensics)
- 34. Chapter 1 Forensic and Investigative Accounting 34 Big-Six's Position • A forensic audit is akin to a police investigation. • All public companies should have a forensic audit on a regular basis. Companies would be required to have such an audit every three or five years or face these audits on a random basis. • Forensic auditors scrutinize all records of companies, including emails, and would be able, if not required, to question all company employees, and to require statements under oath. • Might be necessary for an audit network or a specialized forensic auditors to complete a forensic audit with the aid of independent attorneys (not those who have represented the audit client in the other engagements). Source: “Serving Global Markets and the Global Economy: A View from the CEOs of the International Audit Networks, November 2006, p. 13.
- 35. Chapter 1 Forensic and Investigative Accounting 35 More Differences Two practitioners have suggested these additional procedures may be used in a forensic audit: Extensive use of interviews and leveraging techniques designed to elicit sufficient information to prove or disprove a hypothesis. Document inspection that may extend to authentication procedures and handwriting analysis. Significant public records search to uncover, for example, unexpected title or ownership, other known addresses, and prior records of individuals. Legal knowledge regarding rules of evidence including chain of custody and preservation of evidence integrity. Source: Annett Stalker and M.G. Ueltzen, “An Audit Versus A Fraud Examination,” CPA Expert, Winter 2009, p. 4.
- 36. Chapter 1 Forensic and Investigative Accounting 36 Inexperienced Forensic Auditors • Find out who did it. Do not worry about all the endless details. • Be creative, think like the fraudster, and do not be predictable. Lower the auditing threshold without notice. • Take into consideration that fraud often involves conspiracy. • Internal control lapses often occur during vacations, sick outages, days off, and rest breaks, especially when temporary personnel replace normal employees. H. R. Davia, Fraud 101, New York: John Wiley & Sons, 2000, pp. 42-45.
- 37. The rising allegations of significant fraud and corruption crimes have brought upon a new dimension towards the prominent need for application of auditing expertise to situations that have legal consequences, more widely known as FORENSIC AUDITING Challenged with the responsibility and the trust of stake holders and investors to detect and investigate fraud and other financial reporting misstatements, auditors are increasingly being pushed to be more efficient and pro-active. The increased business complexities in today's litigious environment have enhanced the need for auditors to be ABSOLUTELY, PERFECTLY and UNQUESTIONABLY determined whether financial statements are accurate and incompliance with regulations. Thus there is need to master and understand the tools to tackle and build a solid foundation in fraud PREVENTION, DETECTION, and DETERRENCE. With in-depth understanding on forensic auditing and its impact towards organizations' value.
- 39. • Examples of Fraud • Fraudulent educational qualifications • Pretending that you have the lawful qualifications • Submission of False claims – insurance, kilometers, medical certificates, overtime • Cheque / document fraud • Credit card fraud – using company credit cards for personal expenses • Improper transfer of funds or goods to another person not legally entitles to • Duplicate payments, payment for services or goods not rendered • Or delivered of inferior goods, redundant assets & etc
- 40. • Falsification of invoices • Creation of fictitious supplier accounts • Creation of fictitious employees on the company payroll • Using the organization resources or contracts to run and benefit your own private business ( which may be in conflict with your employer business • Inflating prices / fees for goods rendered or delivered • Falsification of leave register or failure to report leave • Procurement fraud
- 41. Digital Forensics Definition: “Tools and techniques to recover, preserve, and examine digital evidence on or transmitted by digital devices.” Devices include computers, PDAs, cellular phones, videogame consoles, copy machines, printers, …
- 43. FORENSICS IS A FOUR STEP PROCESS • Acquisition • Identification • Evaluation • Presentation