Savitribai Phule Pune University

Audit Report on
Cybersecurity
Submitted in partial fulfillment of the requirement for the award of the degree of

BACHELOR OF ENGINEERING IN
COMPUTER ENGINEERING
[T.E. Computer Engineering]

By

Roll No. 25
Pranav Pratap Bobade
At

Department of Computer Engineering

BHARATI VIDYAPEETH’s COLLEGE OF ENGINEERING
LAVALE, PUNE– 412115.
Academic Year 2024 - 2025

CYBER SECURITY Page 1

 BHARATI VIDYAPEETH’s COLLEGE OF ENGINEERING
LAVALE, PUNE – 412115.
Department of Computer Engineering

This is to certify that, the report on “Cybersecurity” submitted by “PRANAV PRATAP

BOBADE” for partial fulfilment of the requirement for the award of the Bachelor of
Engineering in COMPUTER ENGINEERING at Bharati Vidyapeeth’s College of Engineering
Lavale, Pune as laid down by the Savitribai Phule Pune University. This is a record of the
work carried out under my supervision and guidance during academic year 2024 - 2025.

Place: - Pune.

Prof. Ajit Patil Dr. U. C. Patkar

Internal Guide HOD
Dept. Of Computer Engg. Dept. Of Computer Engg.

CYBER SECURITY Page 2

 S. No Topic Page no

1 Cyber security introduction -Basics 4

2 Types of Cyber attacks 6

3 Vulnerabilities, threats and harmful acts 9

4 CIA Triad 10

5 Cyberspace 18

6 National Cyber security Policy 20

7 Digital Forensics 21

8 Cyber Forensics and Digital Evidences 22

9 Forensic analysis of emails 23

24
10 Digital Forensics Lifecycle

26
11 Challenges in Computer Forensics

27
12 Textbooks/References

CYBER SECURITY Page 3

 Introduction to Cyber Security

Cyber Security Introduction - Cyber Security Basics:

Cyber security is the most concerned matter as cyber threats and attacks are overgrowing.
Attackers are now using more sophisticated techniques to target the systems. Individuals,
small-scale businesses or large organization, are all being impacted. So, all these firms whether
IT or non-IT firms have understood the importance of Cyber Security and focusing on adopting
all possible measures to deal with cyber threats.

What is cyber security?

"Cyber security is primarily about people, processes, and technologies working together to
encompass the full range of threat reduction, vulnerability reduction, deterrence, international
engagement, incident response, resiliency, and recovery policies and activities, including
computer network operations, information assurance, law enforcement, etc."
OR
Cyber security is the body of technologies, processes, and practices designed to protect
networks, computers, programs and data from attack, damage or unauthorized access.

• The term cyber security refers to techniques and practices designed to protect digital
data.

• The data that is stored, transmitted or used on an information system.

OR
Cyber security is the protection of Internet-connected systems, including hardware, software,
and data from cyber attacks.
It is made up of two words one is cyber and other is security.
• Cyber is related to the technology which contains systems, network and programs or
data.

• Whereas security related to the protection which includes systems security, network
security and application and information security.
Why is cyber security important?
Listed below are the reasons why cyber security is so important in what’s become a
predominant digital world:

• Cyber attacks can be extremely expensive for businesses to endure.

• In addition to financial damage suffered by the business, a data breach can also inflict
untold reputational damage.
• Cyber-attacks these days are becoming progressively destructive. Cybercriminals are
using more sophisticated ways to initiate cyber attacks.

CYBER SECURITY Page 4

 • Regulations such as GDPR are forcing organizations into taking better care of the
personal data they hold.

Because of the above reasons, cyber security has become an important part of the
business and the focus now is on developing appropriate response plans that minimize
the damage in the event of a cyber attack.

But, an organization or an individual can develop a proper response plan only when he
has a good grip on cyber security fundamentals.

Cyber security Fundamentals – Confidentiality:

Confidentiality is about preventing the disclosure of data to unauthorized parties.

It also means trying to keep the identity of authorized parties involved in sharing and holding
data private and anonymous.

Often confidentiality is compromised by cracking poorly encrypted data, Man-in-the-middle

(MITM) attacks, disclosing sensitive data.

Standard measures to establish confidentiality include:

• Data encryption
• Two-factor authentication
• Biometric verification
• Security tokens

Integrity

Integrity refers to protecting information from being modified by unauthorized parties.

Standard measures to guarantee integrity include:

• Cryptographic checksums
• Using file permissions
• Uninterrupted power supplies
• Data backups

Availability

Availability is making sure that authorized parties are able to access the information when
needed.

Standard measures to guarantee availability include:

• Backing up data to external drives

• Implementing firewalls
• Having backup power supplies
• Data redundancy

CYBER SECURITY Page 5

Types of Cyber Attacks

A cyber-attack is an exploitation of computer systems and networks. It uses malicious code to

alter computer code, logic or data and lead to cybercrimes, such as information and identity
theft.

Cyber-attacks can be classified into the following categories:

1) Web-based attacks
2) System-based attacks

Web-based attacks

These are the attacks which occur on a website or web applications. Some of the important
web-based attacks are as follows-

1. Injection attacks

It is the attack in which some data will be injected into a web application to manipulate the
application and fetch the required information.

Example- SQL Injection, code Injection, log Injection, XML Injection etc.

2. DNS Spoofing

DNS Spoofing is a type of computer security hacking. Whereby a data is introduced into a DNS
resolver's cache causing the name server to return an incorrect IP address, diverting traffic to
the attackers computer or any other computer. The DNS spoofing attacks can go on for a long
period of time without being detected and can cause serious security issues.

3. Session Hijacking

It is a security attack on a user session over a protected network. Web applications create
cookies to store the state and user sessions. By stealing the cookies, an attacker can have access
to all of the user data.

4. Phishing

Phishing is a type of attack which attempts to steal sensitive information like user login
credentials and credit card number. It occurs when an attacker is masquerading as a trustworthy
entity in electronic communication.

5. Brute force

It is a type of attack which uses a trial and error method. This attack generates a large number
of guesses and validates them to obtain actual data like user password and personal
identification number. This attack may be used by criminals to crack encrypted data, or by
security, analysts to test an organization's network security.

CYBER SECURITY Page 6

6. Denial of Service

It is an attack which meant to make a server or network resource unavailable to the users. It
accomplishes this by flooding the target with traffic or sending it information that triggers a
crash. It uses the single system and single internet connection to attack a server. It can be
classified into the following-

Volume-based attacks- Its goal is to saturate the bandwidth of the attacked site, and is
measured in bit per second.

Protocol attacks- It consumes actual server resources, and is measured in a packet.

Application layer attacks- Its goal is to crash the web server and is measured in request per
second.

7. Dictionary attacks

This type of attack stored the list of a commonly used password and validated them to get
original password.

8. URL Interpretation

It is a type of attack where we can change the certain parts of a URL, and one can make aweb
server to deliver web pages for which he is not authorized to browse.

9. File Inclusion attacks

It is a type of attack that allows an attacker to access unauthorized or essential files which is
available on the web server or to execute malicious files on the web server by making use of
the include functionality.

10. Man in the middle attacks

It is a type of attack that allows an attacker to intercepts the connection between client and
server and acts as a bridge between them. Due to this, an attacker will be able to read, insert
and modify the data in the intercepted connection.

System-based attacks

These are the attacks which are intended to compromise a computer or a computer network.
Some of the important system-based attacks are as follows-

1. Virus

It is a type of malicious software program that spread throughout the computer files without
the knowledge of a user. It is a self-replicating malicious computer program that replicates by
inserting copies of itself into other computer programs when executed. It can also execute
instructions that cause harm to the system.

CYBER SECURITY Page 7

2. Worm

It is a type of malware whose primary function is to replicate itself to spread to uninfected

computers. It works same as the computer virus. Worms often originate from email attachments
that appear to be from trusted senders.

3. Trojan horse

It is a malicious program that occurs unexpected changes to computer setting and unusual
activity, even when the computer should be idle. It misleads the user of its true intent. It appears
to be a normal application but when opened/executed some malicious code will runin the
background.

4. Backdoors

It is a method that bypasses the normal authentication process. A developer may create a
backdoor so that an application or operating system can be accessed for troubleshooting or
other purposes.

5. Bots

A bot (short for "robot") is an automated process that interacts with other network services.
Some bots program run automatically, while others only execute commands when theyreceive
specific input. Common examples of bots program are the crawler, chatroom bots, and
malicious bots.

CYBER SECURITY Page 8

The 7 layers of cyber security should centre on the mission critical assets you are seeking to
protect.

1: Mission Critical Assets – This is the data you need to protect

2: Data Security – Data security controls protect the storage and transfer of data.
3: Application Security – Applications security controls protect access to an application, an
application’s access to your mission critical assets, and the internal security of the application.
4: Endpoint Security – Endpoint security controls protect the connection between devices and
the network.
5: Network Security – Network security controls protect an organization’s network and prevent
unauthorized access of the network.
6: Perimeter Security – Perimeter security controls include both the physical and digital security
methodologies that protect the business overall.
7: The Human Layer – Humans are the weakest link in any cyber security posture. Human
security controls include phishing simulations and access management controls that protect
mission critical assets from a wide variety of human threats, including cyber criminals,
malicious insiders, and negligent users.

Vulnerability, threat, Harmful acts

As the recent epidemic of data breaches illustrates, no system is immune to attacks. Any
company that manages, transmits, stores, or otherwise handles data has to institute and enforce
mechanisms to monitor their cyber environment, identify vulnerabilities, and close upsecurity
holes as quickly as possible.
Before identifying specific dangers to modern data systems, it is crucial to understand the
distinction between cyber threats and vulnerabilities.

Cyber threats are security incidents or circumstances with the potential to have a negative
outcome for your network or other data management systems.
Examples of common types of security threats include phishing attacks that result in the
installation of malware that infects your data, failure of a staff member to follow data
protection protocols that cause a data breach, or even a tornado that takes down your
company’s data headquarters, disrupting access.

Vulnerabilities are the gaps or weaknesses in a system that make threats possible and tempt
threat actors to exploit them.

Types of vulnerabilities in network security include but are not limited to SQL injections, server
misconfigurations, cross-site scripting, and transmitting sensitive data in a non- encrypted plain
text format.
When threat probability is multiplied by the potential loss that may result, cyber security
experts, refer to this as a risk.

CYBER SECURITY Page 9

SECURITY VULNERABILITIES, THREATS AND ATTACKS –
Categories of vulnerabilities
• Corrupted (Loss of integrity)

• Leaky (Loss of confidentiality)

• Unavailable or very slow (Loss of availability)

– Threats represent potential security harm to an asset when vulnerabilities are exploited
- Attacks are threats that have been carried out
• Passive – Make use of information from the system without affecting system
resources

• Active – Alter system resources or affect operation

• Insider – Initiated by an entity inside the organization

• Outsider – Initiated from outside the perimeter

Computer criminals
Computer criminals have access to enormous amounts of hardware, software, and data; they
have the potential to cripple much of effective business and government throughout the world.
In a sense, the purpose of computer security is to prevent these criminals from doing damage.
We say computer crime is any crime involving a computer or aided by the use of one. Although
this definition is admittedly broad, it allows us to consider ways to protect ourselves, our
businesses, and our communities against those who use computers maliciously.
One approach to prevention or moderation is to understand who commits these crimes and why.
Many studies have attempted to determine the characteristics of computer criminals. By
studying those who have already used computers to commit crimes, we may be able in the
future to spot likely criminals and prevent the crimes from occurring.
CIA Triad
The CIA Triad is actually a security model that has been developed to help people think about
various parts of IT security.
CIA triad broken down:

Confidentiality

It's crucial in today's world for people to protect their sensitive, private information from
unauthorized access.

Protecting confidentiality is dependent on being able to define and enforce certain access levels
for information.

CYBER SECURITY Page 10

In some cases, doing this involves separating information into various collections that are
organized by who needs access to the information and how sensitive that information actually
is - i.e. the amount of damage suffered if the confidentiality was breached.

Some of the most common means used to manage confidentiality include access control lists,
volume and file encryption, and Unix file permissions.

Integrity

Data integrity is what the "I" in CIA Triad stands for.

This is an essential component of the CIA Triad and designed to protect data from deletion or
modification from any unauthorized party, and it ensures that when an authorized person makes
a change that should not have been made the damage can be reversed.

Availability

This is the final component of the CIA Triad and refers to the actual availability of your data.
Authentication mechanisms, access channels and systems all have to work properly for the
information they protect and ensure it's available when it is needed.

Understanding the CIA triad

The CIA Triad is all about information. While this is considered the core factor of the majority
of IT security, it promotes a limited view of the security that ignores other importantfactors.

For example, even though availability may serve to make sure you don't lose access to resources
needed to provide information when it is needed, thinking about informationsecurity in itself
doesn't guarantee that someone else hasn't used your hardware resources without authorization.

It's important to understand what the CIA Triad is, how it is used to plan and also to implement
a quality security policy while understanding the various principles behind it. It's also important
to understand the limitations it presents. When you are informed, you can utilize the CIA Triad
for what it has to offer and avoid the consequences that may come along by not understanding
it.

Assets and Threat

What is an Asset: An asset is any data, device or other component of an organization’s systems
that is valuable – often because it contains sensitive data or can be used to access such
information.

For example: An employee’s desktop computer, laptop or company phone would be considered
an asset, as would applications on those devices. Likewise, critical infrastructure, such as
servers and support systems, are assets. An organization’s most common assets are information
assets. These are things such as databases and physical files – i.e. the sensitive data that you
store

CYBER SECURITY Page 11

What is a threat: A threat is any incident that could negatively affect an asset – for example,
if it’s lost, knocked offline or accessed by an unauthorized party.

Threats can be categorized as circumstances that compromise the confidentiality, integrity or

availability of an asset, and can either be intentional or accidental.

Intentional threats include things such as criminal hacking or a malicious insider stealing
information, whereas accidental threats generally involve employee error, a technical
malfunction or an event that causes physical damage, such as a fire or natural disaster.

Motive of Attackers

The categories of cyber-attackers enable us to better understand the attackers' motivationsand

the actions they take. As shown in Figure, operational cyber security risks arise from three
types of actions: i) inadvertent actions (generally by insiders) that are taken without malicious
or harmful intent; ii) deliberate actions (by insiders or outsiders) that are taken intentionally
and are meant to do harm; and iii) inaction (generally by insiders), such as a failure to act in a
given situation, either because of a lack of appropriate skills, knowledge, guidance, or
availability of the correct person to take action Of primary concern here are deliberate actions,
of which there are three categories of motivation.

1. Political motivations: examples include destroying, disrupting, or taking control of

targets; espionage; and making political statements, protests, or retaliatory actions.
2. Economic motivations: examples include theft of intellectual property or other
economically valuable assets (e.g., funds, credit card information); fraud; industrial
espionage and sabotage; and blackmail.
3. Socio-cultural motivations: examples include attacks with philosophical, theological,
political, and even humanitarian goals. Socio-cultural motivations also include fun,
curiosity, and a desire for publicity or ego gratification.

CYBER SECURITY Page 12

Types of cyber-attacker actions and their motivations when deliberate

Active attacks: An active attack is a network exploit in which a hacker attempts to make
changes to data on the target or data en route to the target.

Types of Active attacks:

Masquerade: in this attack, the intruder pretends to be a particular user of a system to gain
access or to gain greater privileges than they are authorized for. A masquerade may be
attempted through the use of stolen login IDs and passwords, through finding security gaps in
programs or through bypassing the authentication mechanism.

Session replay: In this type of attack, a hacker steals an authorized user’s log in information
by stealing the session ID. The intruder gains access and the ability to do anything the
authorized user can do on the website.

Message modification: In this attack, an intruder alters packet header addresses to direct a
message to a different destination or modify the data on a target machine.

In a denial of service (DoS) attack, users are deprived of access to a network or web resource.
This is generally accomplished by overwhelming the target with more traffic than it can handle.

In a distributed denial-of-service (DDoS) exploit, large numbers of compromised systems

(sometimes called a botnet or zombie army) attack a single target.

Passive Attacks:Passive attacks are relatively scarce from a classification perspective, but can
be carried out with relative ease, particularly if the traffic is not encrypted.

Types of Passive attacks:

Eavesdropping (tapping): the attacker simply listens to messages exchanged by two entities.
For the attack to be useful, the traffic must not be encrypted. Any unencrypted information,
such as a password sent in response to an HTTP request, may be retrieved by the attacker.

Traffic analysis: the attacker looks at the metadata transmitted in traffic in order to deduce
information relating to the exchange and the participating entities, e.g. the form of the
exchanged traffic (rate, duration, etc.). In the cases where encrypted data are used, traffic
analysis can also lead to attacks by cryptanalysis, whereby the attacker may obtain information
or succeed in unencrypting the traffic.

Software Attacks: Malicious code (sometimes called malware) is a type of software

designed to take over or damage a computer user's operating system, without the user's
knowledge or approval. It can be very difficult to remove and very damaging. Common
malware examples are listed in the following table:

CYBER SECURITY Page 13

Attack Characteristics
Virus A virus is a program that attempts to damage a computer system and replicate itself
to other computer systems. A virus:

• Requires a host to replicate and usually attaches itself to a host file or a

hard drive sector.
• Replicates each time the host is used.
• Often focuses on destruction or corruption of data.
• Usually attaches to files with execution capabilities such as .doc, .exe, and
.bat extensions.
• Often distributes via e-mail. Many viruses can e-mail themselves to
everyone in your address book.
• Examples: Stoned, Michelangelo, Melissa, I Love You.

Worm A worm is a self-replicating program that can be designed to do any number of

things, such as delete files or send documents via e-mail. A worm can negatively
impact network traffic just in the process of replicating itself. A worm:

• Can install a backdoor in the infected computer.

• Is usually introduced into the system through a vulnerability.
• Infects one system and spreads to other systems on the network.
• Example: Code Red.

Trojan A Trojan horse is a malicious program that is disguised as legitimate software.

horse Discretionary environments are often more vulnerable and susceptible to Trojan
horse attacks because security is user focused and user directed. Thus the
compromise of a user account could lead to the compromise of the entire
environment. A Trojan horse:

• Cannot replicate itself.

• Often contains spying functions (such as a packet sniffer) or backdoor
functions that allow a computer to be remotely controlled from the
network.
• Often is hidden in useful software such as screen savers or games.
• Example: Back Orifice, Net Bus, Whack-a-Mole.

Logic A Logic Bomb is malware that lies dormant until triggered. A logic bomb is a
Bomb specific example of an asynchronous attack.

• A trigger activity may be a specific date and time, the launching of a

specific program, or the processing of a specific type of activity.
• Logic bombs do not self-replicate.

CYBER SECURITY Page 14

Hardware Attacks:
Common hardware attacks include:

• Manufacturing backdoors, for malware or other penetrative purposes; backdoors

aren’t limited to software and hardware, but they also affect embedded radio-
frequency identification (RFID) chips and memory

• Eavesdropping by gaining access to protected memory without opening other

hardware
• Inducing faults, causing the interruption of normal behaviour

• Hardware modification tampering with invasive operations

• Backdoor creation; the presence of hidden methods for bypassing normal computer
authentication systems
• Counterfeiting product assets that can produce extraordinary operations and those
made to gain malicious access to systems.
Cyber Threats-Cyber Warfare:Cyber warfare refers to the use of digital attacks -- like
computer viruses and hacking -- by one country to disrupt the vital computer systems of
another, with the aim of creating damage, death and destruction. Future wars will see
hackers using computer code to attack an enemy's infrastructure, fighting alongside troops
using conventional weapons like guns and missiles.
Cyber warfare involves the actions by a nation-state or international organization to attack
and attempt to damage another nation's computers or information networks through, for
example, computer viruses or denial-of-service attacks.
Cyber Crime:
Cybercrime is criminal activity that either targets or uses a computer, a computer network
or a networked device.Cybercrime is committed by cybercriminals or hackers who want
to make money. Cybercrime is carried out by individuals or organizations.
Some cybercriminals are organized, use advanced techniques and are highly technically
skilled. Others are novice hackers.
Cyber Terrorism:
Cyber terrorism is the convergence of cyberspace and terrorism. It refers to unlawful
attacks and threats of attacks against computers, networks and the information stored
therein when done to intimidate or coerce a government or its people in furtherance of
political or social objectives.
Examples are hacking into computer systems, introducing viruses to vulnerable networks,
web site defacing, Denial-of-service attacks, or terroristic threats made via electronic
communication.
Cyber Espionage:
Cyber spying, or cyber espionage, is the act or practice of obtaining secrets and
information without the permission and knowledge of the holder of the information from

CYBER SECURITY Page 15

individuals, competitors, rivals, groups, governments and enemies for personal, economic,
political or military advantage using methods on the Internet.

Security Policies:

Security policies are a formal set of rules which is issued by an organization to ensure that the
user who are authorized to access company technology and information assets comply with
rules and guidelines related to the security of information.

A security policy also considered to be a "living document" which means that the document
is never finished, but it is continuously updated as requirements of the technology and
employee changes.

We use security policies to manage our network security. Most types of security policies are
automatically created during the installation. We can also customize policies to suit our specific
environment.

Need of Security policies-

1) It increases efficiency.

2) It upholds discipline and accountability

3) It can make or break a business deal

4) It helps to educate employees on security literacy

CYBER SECURITY Page 16

There are some important cyber security policies recommendations describe below-

Virus and Spyware Protection policy:

• It helps to detect threads in files, to detect applications that exhibits suspicious

behavior.
• Removes, and repairs the side effects of viruses and security risks by using signatures.

Firewall Policy:

• It blocks the unauthorized users from accessing the systems and networks that connect
to the Internet.
• It detects the attacks by cybercriminals and removes the unwanted sources of network
traffic.

Intrusion Prevention policy:

• This policy automatically detects and blocks the network attacks and browser attacks.
• It also protects applications from vulnerabilities and checks the contents of one or
more data packages and detects malware which is coming through legal ways.

Application and Device Control:

• This policy protects a system's resources from applications and manages the
peripheral devices that can attach to a system.
• The device control policy applies to both Windows and Mac computers whereas
application control policy can be applied only to Windows clients.

CYBER SECURITY Page 17

 CYBERSPACE & CYBER FORENSICS

CYBERSPACE
Cyberspace can be defined as an intricate environment that involves interactions between
people, software, and services. It is maintained by the worldwide distribution of information
and communication technology devices and networks.
With the benefits carried by the technological advancements, the cyberspace today hasbecome
a common pool used by citizens, businesses, critical information infrastructure,military and
governments in a fashion that makes it hard to induce clear boundaries among these different
groups. The cyberspace is anticipated to become even more complex in the upcoming years,
with the increase in networks and devices connected to it.

NIST Compliance
The Cybersecurity Framework (NCFS), authorized by the National Institute of Standards and
Technology (NIST), offers a harmonized approach to cybersecurity as the most reliable global
certifying body.
NIST Cybersecurity Framework encompasses all required guidelines, standards, and best
practices to manage the cyber-related risks responsibly. This framework is prioritized on
flexibility and cost-effectiveness.
It promotes the resilience and protection of critical infrastructure by: Allowing better
interpretation, management, and reduction of cybersecurity risks – to mitigate data loss, data
misuse, and the subsequent restoration costs Determining the most important activities and
critical operations - to focus on securing them Demonstrates the trust-worthiness of
organizations who secure critical assets Helps to prioritize investments to maximize the
cybersecurity ROI Addresses regulatory and contractual obligations Supports the wider
information security program By combining the NIST CSF framework with ISO/IEC 27001 -
cybersecurity risk management becomes simplified. It also makes communication easier

CYBER SECURITY Page 18

throughout the organization and across the supply chains via a common cybersecurity directive
laid by NIST.
Final Thoughts As human dependence on technology intensifies, cyber laws in India and across
the globe need constant up-gradation and refinements. The pandemic has also pushed much of
the workforce into a remote working module increasing the need for app security. Lawmakers
have to go the extra mile to stay ahead of the impostors, in order to block them at their advent.
Cybercrimes can be controlled but it needs collaborative efforts of the lawmakers, the Internet
or Network providers, the intercessors like banks and shopping sites, and, most importantly,
the users. Only the prudent efforts of these stakeholders, ensuring their confinement to the law
of the cyberland - can bring about online safety and resilience.
THE INDIAN CYBERSPACE

Indian cyberspace was born in 1975 with the establishment of National Informatics Centre
(NIC) with an aim to provide govt with IT solutions. Three networks (NWs) were set up
between 1986 and 1988 to connect various agencies of govt. These NWs were, INDONET
which connected the IBM mainframe installations that made up India’s computerinfrastructure,
NICNET (the NIC NW) a nationwide very small aperture terminal (VSAT) NW for public
sector organisations as well as to connect the central govt with the state govts and district
administrations, the third NW setup was ERNET (the Education and Research Network), to
serve the academic and research communities.

New Internet Policy of 1998 paved the way for services from multiple Internet service
providers (ISPs) and gave boost to the Internet user base grow from 1.4 million in 1999 to over
150 million by Dec 2012. Exponential growth rate is attributed to increasing Internet

CYBER SECURITY Page 19

NATIONAL CYBER SECURITY POLICY
National Cyber Security Policy is a policy framework by Department of Electronics and
Information Technology. It aims at protecting the public and private infrastructure from
cyberattacks. The policy also intends to safeguard "information, such as personal information
(of web users), financial and banking information and sovereign data". This was particularly
relevant in the wake of US National Security Agency (NSA) leaks that suggested the US
government agencies are spying on Indian users, who have no legal or technical safeguards
against it. Ministry of Communications and Information Technology (India)
defines Cyberspace as a complex environment consisting of interactions between people,
software services supported by worldwide distribution of information and communication
technology.
VISION
To build a secure and resilient cyberspace for citizens, business, and government and also to
protect anyone from intervening in user's privacy.
MISSION
To protect information and information infrastructure in cyberspace, build capabilities to
prevent and respond to cyber threat, reduce vulnerabilities and minimize damage from cyber
incidents through a combination of institutional structures, people, processes, technology, and
cooperation.
OBJECTIVE
Ministry of Communications and Information Technology (India) define objectives as follows:

• To create a secure cyber ecosystem in the country, generate adequate trust and
confidence in IT system and transactions in cyberspace and thereby enhance adoption
of IT in all sectors of the economy.
• To create an assurance framework for the design of security policies and promotion and
enabling actions for compliance to global security standards and best practices by way
of conformity assessment (Product, process, technology & people).
• To strengthen the Regulatory Framework for ensuring a SECURE CYBERSPACE
ECOSYSTEM.
• To enhance and create National and Sectoral level 24X7 mechanism for obtaining
strategic information regarding threats to ICT infrastructure, creating scenarios for
response, resolution and crisis management through effective predictive, preventive,
protective response and recovery actions.

CYBER SECURITY Page 20

INTRODUCTION: CYBER FORENSICS
CYBER FORENSICS:
Computer forensics is the application of investigation and analysis techniques to gather and
preserve evidence.
Forensic examiners typically analyze data from personal computers, laptops, personal digital
assistants, cell phones, servers, tapes, and any other type of media. This process can involve
anything from breaking encryption, to executing search warrants with a law enforcement team,
to recovering and analyzing files from hard drives that will be critical evidence in the most
serious civil and criminal cases.

The forensic examination of computers, and data storage media, is a complicated and highly
specialized process. The results of forensic examinations are compiled and included in reports.
In many cases, examiners testify to their findings, where their skills and abilities are put to
ultimate scrutiny.

DIGITAL FORENSICS:

Digital Forensics is defined as the process of preservation, identification, extraction, and

documentation of computer evidence which can be used by the court of law. It is a science of
finding evidence from digital media like a computer, mobile phone, server, or network. It
provides the forensic team with the best techniques and tools to solve complicated digital-
related cases.

Digital Forensics helps the forensic team to analyzes, inspect, identifies, and preserve the
digital evidence residing on various types of electronic devices.

Digital forensic science is a branch of forensic science that focuses on the recovery and
investigation of material found in digital devices related to cybercrime.
THE NEED FOR COMPUTER FORENSICS
Computer forensics is also important because it can save your organization money From a
technical standpoint, the main goal of computer forensics is to identify, collect, preserve, and
analyze data in a way that preserves the integrity of the evidence collected so it can be used
effectively in a legal case.
CYBER FORENSICS AND DIGITAL EVIDENCE:

Digital evidence is information stored or transmitted in binary form that may be relied on in
court. It can be found on a computer hard drive, a mobile phone, among other places. Digital
evidence is commonly associated with electronic crime, or e-crime, such as child pornography
or credit card fraud. However, digital evidence is now used to prosecute all types of crimes,
not just e-crime. For example, suspects' e-mail or mobile phone files might contain critical
evidence regarding their intent, their whereabouts at the time of a crime and their relationship
with other suspects. In 2005, for example, a floppy disk led investigators to the BTK serial
killer who had eluded police capture since 1974 and claimed the lives of at least 10 victims.

CYBER SECURITY Page 21

In an effort to fight e-crime and to collect relevant digital evidence for all crimes, law
enforcement agencies are incorporating the collection and analysis of digital evidence, also
known as computer forensics, into their infrastructure. Law enforcement agencies are
challenged by the need to train officers to collect digital evidence and keep up with rapidly
evolving technologies such as computer operating systems.

FORENSICS ANALYSIS OF EMAIL:

E-mail forensics refers to the study of source and content of e-mail as evidence to identify the
actual sender and recipient of a message, data/time of transmission, detailed record of e-mail
transaction, intent of the sender, etc. This study involves investigation of metadata, keyword
searching, port scanning, etc. for authorship attribution and identification of e-mail scams.

Various approaches that are used for e-mail forensic are:

• Header Analysis – Meta data in the e-mail message in the form of control information
i.e. envelope and headers including headers in the message body contain information
about the sender and/or the path along which the message has traversed. Some of these
may be spoofed to conceal the identity of the sender. A detailed analysis of these
headers and their correlation is performed in header analysis.

• Bait Tactics – In bait tactic investigation an e-mail with http: “<imgsrc>” tag having
image source at some computer monitored by the investigators is send to the sender of
e-mail under investigation containing real (genuine) e-mail address. When the e-mail
is opened, a log entry containing the IP address of the recipient (sender of the e-mail
under investigation) is recorded on the http server hosting the image and thus sender
is tracked. However, if the recipient (sender of the e-mail under investigation) is using
a proxy server then IP address of the proxy server is recorded. The log on proxyserver
can be used to track the sender of the e-mail under investigation. If the proxy server’s
log is unavailable due to some reason, then investigators may send the tactic e-mail
containing a) Embedded Java Applet that runs on receiver’s computer or b) HTML page
with Active X Object. Both aiming to extract IP address of the receiver’s computer and
e-mail it to the investigators.

• Server Investigation – In this investigation, copies of delivered e-mails and server logs
are investigated to identify source of an e-mail message. E-mails purged from theclients
(senders or receivers) whose recovery is impossible may be requested from servers
(Proxy or ISP) as most of them store a copy of all e-mails after their deliveries. Further,
logs maintained by servers can be studied to trace the address of the computer
responsible for making the e-mail transaction. However, servers store the copies of e-
mail and server logs only for some limited periods and some may not co-operate with
the investigators. Further, SMTP servers which store data like credit card number and
other data pertaining to owner of a mailbox can be used to identify person behind an e-
mail address.

• Network Device Investigation – In this form of e-mail investigation, logs maintained

by the network devices such as routers, firewalls and switches are used to investigate

CYBER SECURITY Page 22

 the source of an e-mail message. This form of investigation is complex and is used only
when the logs of servers (Proxy or ISP) are unavailable due to some reason, e.g. when
ISP or proxy does not maintain a log or lack of co-operation by ISP’s or failure to
maintain chain of evidence.

• Software Embedded Identifiers – Some information about the creator of e-mail,

attached files or documents may be included with the message by the e-mail software
used by the sender for composing e-mail. This information may be included in the form
of custom headers or in the form of MIME content as a Transport Neutral Encapsulation
Format (TNEF). Investigating the e-mail for these details may reveal some vital
information about the senders e-mail preferences and options that could help client side
evidence gathering. The investigation can reveal PST file names, Windows logon
username, MAC address, etc. of the client computer used to send e- mail message.

• Sender Mailer Fingerprints – Identification of software handling e-mail at server can

be revealed from the Received header field and identification of software handling e-
mail at client can be ascertained by using different set of headers like “X- Mailer” or
equivalent. These headers describe applications and their versions used at the clients to
send e-mail. This information about the client computer of the sendercan be used to
help investigators devise an effective plan and thus prove to be very useful.

EMAIL FORENSICS TOOLS

Erasing or deleting an email doesn’t necessarily mean that it is gone forever. Often emails
can be forensically extracted even after deletion. Forensic tracing of e-mail is similar to
traditional detective work. It is used for retrieving information from mailbox files.

• MiTec Mail Viewer – This is a viewer for Outlook Express, Windows Mail/Windows
Live Mail, Mozilla Thunderbird message databases, and single EML files. It displays a
list of contained messages with all needed properties, like an ordinary e-mail client.
Messages can be viewed in detailed view, including attachments and an HTML
preview. It has powerful searching and filtering capability and also allows extracting
email addresses from all emails in opened folder to list by one click. Selected messages
can be saved to eml files with or without their attachments. Attachments can be
extracted from selected messages by one command.

• OST and PST Viewer – Nucleus Technologies’ OST and PST viewer tools help you
view OST and PST files easily without connecting to an MS Exchange server. These
tools allow the user to scan OST and PST files and they display the data saved in it
including email messages, contacts, calendars, notes, etc., in a proper folder structure.

• eMailTrackerPro – eMailTrackerPro analyses the headers of an e-mail to detect the

IP address of the machine that sent the message so that the sender can be tracked down.
It can trace multiple e-mails at the same time and easily keep track of them.The
geographical location of an IP address is key information for determining the threat
level or validity of an e-mail message.

CYBER SECURITY Page 23

 • EmailTracer – EmailTracer is an Indian effort in cyber forensics by the Resource
Centre for Cyber Forensics (RCCF) which is a premier centre for cyber forensics in
India. It develops cyber forensic tools based on the requirements of law enforcement
agencies.

DIGITAL FORENSICS LIFECYCLE:

Collection: The first step in the forensic process is to identify potential sources of data and
acquire data from them.
Examination:After data has been collected, the next phase is to examine the data, which
involves assessing and extracting the relevant pieces of information from the collected data.
This phase may also involve bypassing or mitigating OS or application features that obscure
data and code, such as data compression, encryption, and access control mechanisms.
Analysis: Once the relevant information has been extracted, the analyst should study and
analyze the data to draw conclusions from it. The foundation of forensics is using a methodical
approach to reach appropriate conclusions based on the available data or determine that no
conclusion can yet be drawn.
Reporting: The process of preparing and presenting the information resulting from theanalysis
phase. Many factors affect reporting, including the following:
a. Alternative Explanations:When the information regarding an event is incomplete, it
may not be possible to arrive at a definitive explanation of what happened. When an
event has two or more plausible explanations, each should be given due consideration
in the reporting process. Analysts should use a methodical approach to attempt to prove
or disprove each possible explanation that is proposed.

b. Audience Consideration. Knowing the audience to which the data or information will
be shown is important.

CYBER SECURITY Page 24

 c. Actionable Information. Reporting also includes identifying actionable information
gained from data that may allow an analyst to collect new sources of information
FORENSICS INVESTIGATION:
Forensics are the scientific methods used to solve a crime. Forensic investigation is the
gathering and analysis of all crime-related physical evidence in order to come to a conclusion
about a suspect. Investigators will look at blood, fluid, or fingerprints, residue, hard drives,
computers, or other technology to establish how a crime took place. This is a generaldefinition,
though, since there are a number of different types of forensics.
TYPES OF FORENSICS INVESTIGATION
• Forensic Accounting / Auditing
• Computer or Cyber Forensics
• Crime Scene Forensics
• Forensic Archaeology
• Forensic Dentistry
• Forensic Entomology
• Forensic Graphology
• Forensic Pathology
• Forensic Psychology
• Forensic Science
• Forensic Toxicology

CHALLENGES IN COMPUTER FORENSICS

Digital forensics has been defined as the use of scientifically derived and proven methods
towards the identification, collection, preservation, validation, analysis, interpretation, and
presentation of digital evidence derivative from digital sources to facilitate the reconstruction
of events found to be criminal.But these digital forensics investigation methods face some
major challenges at the time of practical implementation. Digital forensic challenges are
categorized into three major heads as per Fahdi, Clark, and Furnell are:

• Technical challenges
• Legal challenges
• Resource Challenges

TECHNICAL CHALLENGES

As technology develops crimes and criminals are also developed with it. Digital forensic
experts use forensic tools for collecting shreds of evidence against criminals and criminals use
such tools for hiding, altering or removing the traces of their crime, in digital forensic this
process is called Anti- forensics technique which is considered as a major challenge in digital
forensics world.

Anti-forensics techniques are categorized into the following types:

S. No. Type Description

1 Encryption It is legitimately used for ensuring the privacy of

CYBER SECURITY Page 25

 information by keeping it hidden from an
unauthorized user/person. Unfortunately, it can also
be used by criminals to hide their crimes
2 Data hiding in storage space Criminals usually hide chunks of data inside the
storage medium in invisible form by using system
commands, and programs.
3 Covert Channel A covert channel is a communication protocol which
allows an attacker to bypass intrusion detection
technique and hide data over the network. The
attacker used it for hiding the connection
between him and the compromised system.

Other Technical challenges are:

• Operating in the cloud

• Time to archive data
• Skill gap
• Steganography

LEGAL CHALLENGES

The presentation of digital evidence is more difficult than its collection because there are many
instances where the legal framework acquires a soft approach and does not recognize every
aspect of cyber forensics, as in Jagdeo Singh V. The State and Ors case Hon’ble High Court of
Delhi held that “while dealing with the admissibility of an intercepted telephone call in a CD
and CDR which was without a certificate under Sec. 65B of the Indian Evidence Act, 1872 the
court observed that the secondary electronic evidence without certificate u/s. 65B of Indian
Evidence Act, 1872 is not admissible and cannot be looked into by the court for any purpose
whatsoever.” This happens in most of the cases as the cyber police lack the necessary
qualification and ability to identify a possible source of evidence and prove it. Besides, most
of the time electronic evidence is challenged in the court due to its integrity. In the absence of
proper guidelines and the nonexistence of proper explanation of the collection, and acquisition
of electronic evidence gets dismissed in itself.

Legal Challenges

S.No. Type Description

1 Absence of guidelines and In India, there are no proper guidelines for the
standards collection and acquisition of digital evidence. The
investigating agencies and forensic laboratories are
working on the guidelines of their own. Due to this,
the potential of digital evidence has been destroyed.
2 Limitation of the Indian The Indian Evidence Act, 1872 have limited approach,
Evidence Act, 1872 it is not able to evolve with the time and address the
E-evidence are more susceptible to tampering,
alteration, transposition, etc. the Act is silent on the
method of collection of e-evidence it only focuses on
the presentation of electronic evidence in the court by
accompanying a certificate as per subsection 4 of Sec.
65B[12].

CYBER SECURITY Page 26

 Other Legal Challenges

• Privacy Issues
• Admissibility in Courts
• Preservation of electronic evidence
• Power for gathering digital evidence
• Analyzing a running computer

Resource Challenges

As the rate of crime increases the number of data increases and the burden to analyze such huge
data is also increasing on a digital forensic expert because digital evidence is more sensitive as
compared to physical evidence it can easily disappear. For making the investigation process
fast and useful forensic experts use various tools to check the authenticity of the data but
dealing with these tools is also a challenge in itself.

Types of Resource Challenges are:

• Change in technology

Due to rapid change in technology like operating systems, application software and hardware,
reading of digital evidence becoming more difficult because new version software’s are not
supported to an older version and the software developing companies did provide any backward
compatible’s which also affects legally.

• Volume and replication

The confidentiality, availability, and integrity of electronic documents are easily get
manipulated. The combination of wide-area networks and the internet form a big network that
allows flowing data beyond the physical boundaries.

TEXT BOOKS:
1. Nina Godbole and SunitBelpure, Cyber Security Understanding Cyber
Crimes,Computer Forensics and Legal Perspectives,Wiley

2. B.B.Gupta,D.P.Agrawal,HaoxiangWang,ComputerandCyberSecurity:Principle
s, Algorithm, Applications, and Perspectives, CRC Press, ISBN
9780815371335,2018.

REFERENCES:
1. Cyber Security Essentials, James Graham, Richard Howard and Ryan Otson,
CRCPress.

2. Introduction to Cyber Security, Chwan-Hwa(john) Wu,J. David Irwin, CRC Press

T&FGroup.
f

CYBER SECURITY Page 27