Double-Edged Sword: Dual-Purpose Cyber Security Methods

Abstract

Using forensics techniques, organizations can uncover vital evidence and information regarding intrusion methods and techniques, what actions an intruder took when inside the system or network and what information was taken. However, anti-forensic techniques are being used by cyber-criminals to remove the traces which can be used to successfully investigate their intrusion or cover the fact that an intrusion has taken place. Many of the modern cyber-security programs that are used to defend networks, and the data held within them, are being used by those who would wish to enter these systems without permission—they are a double-edged sword. Cyber-security applications provide important advantages to security professionals. Nevertheless, these advantages are reduced, or lost, when they are used by cyber-criminals in an anti-forensics manner. This chapter explores how common security techniques and methods, such as system logging, vulnerability scanning, and network monitoring, can be misused by cyber-criminals to hide their presence on the network. It then explores some simple security practices and approaches that can be used by network defenders to reduce the effectiveness of these anti-forensic practices.