Cyber Crime - Foundation

Curriculum

Core Concepts

Cyber-attacks and cyber-offences

The nature of different cyber-attacks and their correlation to cyber-offences.

Network protocols and network security

The TCP/IP protocol suite with all its supporting protocols and their contribution to security technologies and controls.

Digital currency concepts

Virtual currency as a concept and as a culture expanding into the relevant technologies.

Operating systems

The modern operating systems used in computing devices including computers, game consoles, mobile phones and embedded devices.

Open source intelligence

Using native operating systems commands for performing basic open source intelligence searches.

Cloud and virtualisation

What different types of cloud services are available, how virtualisation works and how it can impact an investigation.

Live digital forensics

Gain an understanding of live digital forensic techniques and the impact they have on the integrity of an investigation.

Principles of digital forensics

Work with a DFI (Digital Forensics Investigator) and understanding what they can do. Gain a basic understanding of ISO 17025.

Principles of digital evidence

The ACPO Principles of Digital Evidence.

Network architectures & topologies

Gain a basic understanding of simple network topologies and architectures, and how different devices can interact with and become part of a network.

Crime scene management

Managing the Digital/Logical Crime Scene.

Relevant legislation

The various areas of legislation that are fundamental to core areas of cyber criminality, such as Computer Misuse Act, Human Rights Act, Data Protection Act and Regulation of Investigatory Powers Act.

Understanding of neurodiversity

Gain an understanding of neurodiversity and the autistic spectrum.

Example Terms, Techniques and Technologies

Cyber-attack and cyber-offence topology

Detailed correlation between attacks and offences expanding into cyber-crime, hacktivism, cyber espionage and cyber warfare.

TCP, IP, UDP, ARP/RARP, ICMP, IGMP, SMTP, SNMP, POP3, IMAP4, HTTP, FTP, SSH, Telnet

Protocol purpose, headers and application.

Technical cyber-attacks

Man-in-the-middle, denial of service (including DDoS), defacement, SQLite, malware, backdoors (including misconfigurations), targeted attacks.

Linux/Android operating system

Basic setup of Linux/Android operating systems using virtualisation.

Mac/iOS operating system

Basic setup of Mac/iOS operating systems using virtualisation.

Windows operating systems

Basic setup of Windows operating systems using virtualisation.

Wireless networking

Wireless networking protocols.

Encryption

How encryption works and its impact on an investigation. Including the difference between encryption types and hashing.

Continuity of evidence & chain of custody

How to maintain and ensure chain of custody for digital devices and evidence.

ACPO Principles of Digital Evidence

Understanding the four principles: Prepare, Prevent, Protect and Pursue.

Exhibit identification & exhibit seizure

Being able to recognise and identify potential sources of digital evidence, and being able to seize different types of storage media.

Games consoles & embedded devices

Types, opportunities and timescales for examinations and likely standard outputs.

Home and business network setups

Typical setups and configurations. Things to consider for both in terms of opportunities and management of scenes.

Initial live device handling

Initial handling of different devices whether live (switched on) or ‘dead box’ (switched off) as well as other devices such as routers.

Legislation and powers

CMA, HRA, DPA, RIPA etc.

Live digital device risks

Identification and management of potential risks.

Risk assessments

How to complete and review risk assessments.

Scene mapping & scene searching

Physical mapping of a scene involving digital evidence sources, including identifying potential lines of enquiry.

Seizures relating to digital media

The actual process of safely seizing different forms of digital media.

Servers

Types, opportunities and timescales for examinations and likely standard outputs.

The Internet of Things (IoT)

Overview of the concept behind IoT.

Learning Objectives

Knowledge and understanding

• Detailed knowledge of how cyber-attacks correlate to cyber-offences
• Identifies and communicates clearly principles and concepts of modern networks and operating systems
• Collects and synthesises information to inform a choice of solutions/enquiries towards the successful prosecution of cyber offences
• Demonstrates an awareness of specialist cyber resource roles, responsibilities, skills and capabilities
• Has a broad understand of the concepts surrounding the ACPO Principles of Digital Evidence

Performance and practice

• Have a broad understanding of network topologies and digital devices that can be found within the modern crime scene
• Undertakes complex and non-routine tasks for managing cases relating to cyber-offences
• Interact effectively within a team, giving and receiving information and ideas and modifying responses where appropriate
• Demonstrates awareness of legislative issues with Computer Misuse Act, Human Rights Act, Data Protection Act, Telecommunications Act, Child Protection Act and Regulation of Investigatory Powers Act, as they apply to evidence handling and cyber incident management
• Demonstrates safe handling, seizure and transportation of digital evidence and related articles, including associated risks