Well, we know one of the things that we are going to be collecting when
we were on an investigation for some type of cyber attack is evidence,
but evidence is going to come in.
Different forms were going to be able to do various things with it, so
let's dive deeper into this topic of evidence.
In this episode,
you're watching TV.
So Ronnie, I love it.
We're going to go over to the evidence Locker.
See that's the only like term I've ever picked up from watching crime dramas.
But anyways, evidence is super important an I'm so
glad you're going to give us some clarity on the different types of evidence.
And I think our focus, as you said in the title,
is going to be an all that great information that we can get in logs.
Yeah, there's no doubt that to me it's kind of neat 'cause I do
like those types of crime dramas and I do like the idea when I hear them.
Talk about this stuff of what is good evidence an what is corroborating
evidence?
What is indirect or the idea of circumstance you have done.
Sometimes it's hard to distinguish what they actually mean, but we're going to
talk about that specifically, but from the cyber security standpoint, right from
the side drops world, most of it right is not involving some type of capital crime.
It's going to be involving some type of computer crime and
that actually by that point when it gets of course to the court,
it's not something you're investigating that that's happening a lot of times.
It's actually something that's.
After the fact, so that means what we have to do is we have to examine,
well everything, right?
We do analysis on everything that we can, but
a lot of what will be presenting is going to be from the standpoint of logs and
understanding what we can actually do that helps us out here.
So as much as I'd like to talk about everything,
we're going to actually kind of focus in on the idea of logs.
But before we get started, nothing.
Let's talk about the concept of evidence itself, and this is going to be key
when we start to take a look, especially when we start doing analysis here.
So when we actually say hey, we need to make.
Sure that we gather all this information for evidence, right?
Well, what do we actually mean by that?
Evidence itself is really the basis for
some type of factual statement you're going to make.
So, for example, I'm going to set the little crime scenario here.
A computer crime scenario?
An anti is going to be the bad guy at this point, but he's going to help me out too.
So when we talked about this right, someone can actually walk in and go.
Hey, here's what we actually need to do is.
I know the Anthony did it, but
just like you hear about in those crime dramas an thing.
Even though I may know, we have to actually be able to prove it.
So I make a particular statement, and I say Anthony,
you are the one that did it now on a crime drama anti if we were face to face,
what could you actually say there?
I would absolutely say it wasn't me.
It wasn't me.
There's no chance I did this, I'm innocent, yeah.
I mean that's what all of us would say, right?
But now it's the time.
Then we talk about evidence I need to present what it is that actually
is the basis for my factual statement that Anthony did it.
So even though it sounds like it's just facts itself,
it can be that's the dad that helps us.
But for us here, right?
It's actually making sure that that backs up the claim that we just made.
Because we can gather so many facts but
a lot of it has to come down to relevancy there as well.
So remember, it's the basis for a factual statement or a claim that were doing so.
We actually do have to begin to collect that we can just pull things out of thin
air and make it happen, right?
Is collected data that verifies that factual statement itself.
So what we're doing now is actually ensuring that whatever we collect,
we have to weed out the stuff that really isn't relevant.
And then what we have left.
We believe that it verifies the claim that I did that I made, which is the Anthony
did it now, even if I can actually do all of that normally inside that crime drama.
Anthony, there's always this twist, and the twist is,
your lawyer essentially says.
Yeah, you got a lot of evidence there.
But who collected it?
How was it collected?
And that's when we actually all of a sudden have to go.
Well, you know, so.
And so told me that Anthony did it and then I was able to actually ask someone.
So to get me that, you know that particular log or
that data out there that made that work well?
How did that obtain obtain that?
That's where it now becomes, a little bit more tricky because we have to realize
something in terms of evidence that we're going to present to be that basis of
the factual statements itself that I'm making has be collected in a proper order.
So in other words, I can't.
Sneak into Anthony's house, okay?
And actually go?
I found the evidence that I need, and I just take it, okay.
Nor even though Anthony might be here with me, and he might have his laptop bag here.
Okay.
I can't just go through Anthony's laptop bag without him knowing about it.
Okay, to get the evidence that I need.
Now, Anthony, if I do something like that, okay,
that actually is probably more than anything else, right, stealing.
Okay.
And what do you think that, if you were to think about a crime job, okay,
when we talk about that, I stole the data, okay.
And then in a court of law, what do you normally think or
hear that happens when we hear it on a crime drama?
>> Yeah, so, Ronnie, you stole the data.
And of course, you're indicating that you didn't.
And so what's the exact question?
I wanna make sure I understand exactly what you're asking.
>> So if I actually presented that data, right?
And I stole it, Anthony, your lawyer could say what?
>> That, yeah, that you didn't steal the data, that someone else gave it to you.
Or you acquired it through some other means.
>> Yeah. So in that sense, right.
The very fact that he could say, well, Ronnie, how did you get it?
Yeah, I got it from so and so.
How did you really get it?
Well, I went into Anthony's book bag.
So let's put Anthony on the stand here.
Anthony, was Ronnie supposed to be in your book bag?
No. >> Absolutely not.
>> Yeah. So in other words,
you can actually see how this can actually play out.
So evidence has to actually be obtained in that proper format in the investigation.
It has to be relevant, which is what that second point is.
It has to be able to support what that factual statement is going to be.
If it doesn't, it's not evidence.
It's just regular data that's out there.
Okay, we can point out a lot of stuff here, but overall,
though it's not everything, it has to actually be relevant.
It has to be obtained properly.
Essentially is what it does and support what we're doing right.
Now, when it comes down to logs though, okay,
logs again can kind of be rated, right.
I think that's kind of the easiest term that I could do.
Based on the idea here of different types of evidence that we could do.
We could actually present what we call the best type of evidence.
We can present what we call corroborative evidence and, of course,
indirect evidence too, okay?
Now that third term's a little bit tricky because we don't normally hear the term
indirect evidence because that word is not as grandiose as
the other word that you normally here, which is circumstantial evidence,
is what you tend to hear instead on these court dramas.
Okay, so let's talk about the idea of best evidence here, okay?
Best evidence is the original unaltered data, and
that is what is normally preferred.
Now, when you hear about that, the idea of eyewitnesses, right.
And what I mean, that means somebody was there at the time that Anthony committed
that particular computer crime.
So let's say that Anthony was sitting there again.
I'm making up this scenario, right?
Anthony was sitting there along with a friend of his.
And then he said, just I'm gonna hack into the system.
And now if I can get the person that was actually right there,
that watched Anthony do it, that's an eyewitness.
That's original.
It is unaltered.
He was there.
He's not presenting some type of other type of audits.
He says, I was there.
I watched him do it.
Okay.
Now, in terms of computers, though, we're normally not gonna find that unless you
really strike down, strike insanely lucky here.
Okay, but what does that mean we can present?
Well in a court, right?
In some type of legal case or deposition setting, we can actually say, hey,
look, here is the system that Anthony used in the attack itself.
So in other words, I go and I actually obtain that evidence properly, and
I get Anthony's laptop,
the system that I believe that he actually used in the attack.
Okay, so from that point, we could do that.
Okay, so that's kind of the idea of physical evidence, right?
So it's not a representation.
It's not a mock up of Anthony's computer.
It's Anthony's computer, okay?
And then from that point, we could actually do a lot once we have that right?
So best evidence is the original unaltered data.
Now let's talk about it from the standpoint of logs.
Okay, so what we're actually trying to do is we're trying to find logs.
In other words, evidence has actually been left behind from the actual attack itself.
So here I've given an example,
the actual net flow spike from that attack that Anthony created.
So in other words, if I can find that particular spike,
I can find a lot of other things here.
But I could say, here's exactly what happened.
Now that doesn't trace it all the way back to Anthony at this point.
But at the same time, it is real evidence that there it is,
the system actually caught the attack as it happened here.
So this is not a mock up, a representation again.
It's the real log that shows what happened during that attack.
Okay, so That's gonna be key evidence that we can actually present in terms
of logging overall is to find that stuff that actually indicates when it happened
indicates maybe here when I talk about the idea of spike of the traffic that happened
at the time, whatever it is, whatever systems that I have in place all those
particular systems, if they were set up the way that I hope that they were set up,
that they may present me the idea of actually saying, Yep, here are the systems
that were triggered as anti went through and created. This type of attack,
so that's what we can do when it comes down to best evidence All right now,
sometimes though, if Anthea is the careful cyber attacker that he is, and
they let's say that you were actually able to get into a system because you,
you're actually a malicious Insider, okay?
And they can logs be easily erased at times on certain systems?
Absolutely. An in fact Ronnie, that is like you know you've talked
several times in the Cyber OPS associate class about how their different
phases of an attack and different aspects of an attack. And
it's really interesting because like we know there's reconnaissance almost all
the time. Initially One of the other things that we're dealing with constantly,
it seems like is attackers trying to cover their tracks.
So they're smart.
They know log files are key to us when it comes to evidence.
And so they'll try and destroy that evidence as part of the attack.>> Yeah,
so we do need to be careful.
Sometimes what we end up with though, is not always the best evidence.
Don't get me wrong, it's ideal we have it.
But a lot of times we don't get that.
So what do we get?
instead?
We might get what we call corroborative evidence instead or
corroborating evidence, right?
additional evidence to support the presented evidence.
So let's say that I did get that log, but Anthony can come back or
his learner can come back and go well, Doesn't really prove that the anthy
did it so far and we can kind of give them that at this particular point.
But anthy mashi claim, I don't even know how to do that type of attack or
whatever it might be, you know he can present.
But what can we do to corroborate that the attack can take place.
in the way that was described, and that I'm going to somehow link this to Anthony?
What we can do is we can bring in another expert in if we chose to Anri
demonstrate the attack that happened to show that it can actually lead to.
The same type of log that the net flow system actually created,
so we can actually show the log of what actually Even though it's a rip
a recreation, and then match it up to the original attack itself, and
then now I can actually start doing some other things right?
I can actually start to take a look at evidence here and go.
Now let's see how we can tie that into Anthony a lot of times and
actually be able to prove stuff like the stadium So in that sense.
And he goes. I wouldn't. Not only would I never do that type of attack, but
I don't think I could actually do that attack. So what would I do?
I'd go to YouTube and start searching at the Sequeira,
an cybersecurity demonstration on these attacks. And there it is.
I find a YouTube of Anthony doing An attack that's very similar, okay?
And that uses those same skills that uses exactly that.
And then, Anthony also demonstrating and explaining how that work.
Anthony do you think that that would kind of corroborate that you would know how to
do something like that?
It's your word, Ronnie.
And I got to admit you have me here laughing at myself that how foolish I am.
>> [LAUGH] >> Yeah, I love it.
The Anthony Sequeira YouTube page.
Hey, look at this really cool cyber attack.
>> Yeah. And so.>> One of a kind.
No one in the world would be able to do this but me.
>> Yeah. So if you think about that,
right that's not necessarily showing you doing the attack.
But if you had made that claim somehow I can't do an attack like that.
There's no way and then I show something like that happening.
I show here's the level of skill that you need to do it.
And you know, and be able to do that, that corroborate something like that.
Okay, so that's the idea here.
Okay. Now, a lot of times And
this is kind of unusual, right?.
Corroborative types of evidence can actually be even stronger than the direct
evidence itself.
Because it's independently essentially saying, nope, Anthony can do it.
That's what it's essentially really saying, right?
Is that yes, it can be done.
Yes. It's gonna happen that way.
So in other words is not me manipulating as me saying.
Here's proof that it can be done and the way that Anthony says he can't do it.
Okay? So that's one thing, but
the other one that we can do is what we call indirect evidence.
Again, same thing circumstantial evidence, indirect evidence is the same.
So what is the key here?
The key is not so
much that I am actually presenting any type of corroborating evidence anymore.
I'm presenting other Additional facts that now I can
leave it to someone to infer that Anthony did it.
So that's a little bit unusual athlete.
How does that feel?
Is that I can actually lead such a breadcrumb of things?
I'm saying here's anthonys means.
Here's his motive.
Here's the way that he actually did it, and then allow them to actually
end up inferring from those things that you actually made that crime happen.
Yeah, it doesn't seem all that fair I guess, but
you know a lot of times this kind of evidence is powerful enough where it's
clear that you know we really have caught the individual, and
I suppose a lot of this has to do with are we dealing with policies?
For, as you alluded to, Rania love it,
internal employees versus are we in like a court of law?
Right, you know where where you know it's interesting with our own internal
employees.
It's going to be a lot easier.
It's going to be a lot cut and dry.
We can just say look all the evidence points you do in this and
we have a record of you using your machine in an unauthorized manner, so
that's enough to terminate you.
But I'm sure things get so
much trickier when we're not dealing inside our Corporation.
Only were dealing in a public court of law, even last example that I list
here showing the user login at same time the attack happened.
Now Anthony, you could claim.
I may have been logged in at the same time.
I didn't create the attack.
You wanna know something that's justifiable but
I can leave that out there as circumstantial evidence and
then I can let somebody else infer that that's happened.
So taking a look at this idea of especially logging information,
we have to realize that sometimes it is the best evidence.
A lot of times it is going to be the idea of some type of corroborating evidence
that we're trying to be able to present, or it may be the idea of some type of
indirect evidence here that were actually kind of just wrapping up the entire
package for whoever actually needs that particular evidence.
The majority of times it may be where it goes all the way to the Court of Law, but
there are times out 'cause that's the neat thing to actually talk about, right?
Exactly what Anthony said.
Its internal is to stuff that we need to verify and to be able to prove that hey
beyond a shadow of doubt, here's what actually happened.
And here's how we can actually show you that it happened, and
that may be enough so it doesn't have to go through every single one of this
about the Super proper technical way that you got it, but
it does actually need to be, at least in your mind.
If this is something of that point, where is about a prosecution of some sort,
so anti hopefully that's a good kind of at least introduction.
To the evidence that we can actually use based on logs.
It sure is Ronnie.
Thank you so much.
That was super interesting.
I told you before the show that I thought I would learn a lot in this episode and
I certainly did and I don't know about you, Ronnie.
I don't know about our viewers, but
I had the show Dexter pop into my head about 19 times during that episode.
So yeah, Ronnie, did you watch that show?
I did not put it on your list.
As long as you can take.
Gore alright well anyways everyone thank you so much for
your tendons in this episode of our Cyber OPS associate Show.
Big shout out to Ronnie for guiding us through some great details on
the important topic of evidence will be back with more great cyber
OPS associate data and information and great videos for you.
But for Dow signing off on behalf of Ronnie Wong and myself,
Anthony Sequeira were sure glad you joined us for Cyber OPS associate.
Here at protv.
Thank you for watching protein.