#FactCheck - Deepfake Video Falsely Claims visuals of a massive rally held in Manipur

Introduction:

Digital Forensics, as the term goes, “It is the process of collecting, preserving, identifying, analyzing, and presenting digital evidence in a way that the evidence is legally admitted.”

It is like a detective work in the digital realm, where investigators use various specific methods to find deleted files and to reveal destroyed messages.

The reason why Digital Forensics is an important field is because with the  advancement of technology and the use of digital devices, the role of Digital Forensics in preserving the evidence and protecting our data from cybercrime is becoming more and more crucial.

Digital Forensics is used in various situations such as:

• Criminal Investigations: Digital Forensics enables investigators to trace back cyber threat actors and further identify victims of the crime to  gather evidence needed to punish criminals.

• Legal issues: Digital Forensics might aid in legal  matters involving intellectual property infringement and data breaches etc.

Types of Digital Data in Digital Forensics:

1.Persistent (Non-volatile) Data :-

• This type of Data Remains Intact When The Computer Is Turned Off.
• ex. Hard-disk, Flash-drives

2.  Volatile Data :-

• These types of Data Would Be Lost When The Computer Is Turned Off.
• ex. Temp. Files, Unsaved OpenFiles, etc.

The Digital Forensics Process

The process is as follows

• Evidence Acquisition: This process involves making an exact copy (forensic image) of the storage devices such as hard drives, SSD or mobile devices. The goal is to preserve the original data without changing it.

• Data Recovery: After acquiring the forensic image, the analysts use  tools to recover deleted, hidden or the  encrypted data inside the device . 

• Timeline Analysis: Analysts use timestamp information from files, and system logs to reconstruct the timeline of activities on a device. This helps in understanding how an incident spanned out and who was involved in it.

• Malware Analysis: In cases involving  security breaches, analysts analyze malware samples to understand their behavior, impact, and origins. various reverse engineering techniques are used to analyze the malicious code.

Types of tools:

• Faraday Bags: Faraday bags are generally the first step in digital evidence capture. These bags are generally made of conductive materials, which are used to shield our electronic devices from external waves such as WiFi, Bluetooth, and mobile cellular signals, which in turn protects the digital evidence from external tampering.

• Data recovery : These types of software are generally used for the recovery of deleted files and their associated data.  Ex. Magnet Forensics, Access data, X-Ways

• Disk imaging and analysis :These types of softwares are Generally used to replicate the data storage devices and then perform further analysis on it ex. FTKImager, Autopsy, and, Sleuth Kit

• File carving tools: They are generally used to extract information from the embedded files in the image made. Ex.Foremost, Binwalk, Scalpel

Some common tools:

• EnCase: It is a tool for acquiring, analyzing, and reporting digital evidence.

• Autopsy: It is an open-source platform generally used for analyzing hard drives and smartphones.

• Volatility: It is a framework used generally for memory forensics to analyze volatile memory dumps and extract info.

• Sleuth Kit: It is a package of CLI tools for investigating disk images and its associated file systems.

• Cellebrite UFED: It is a tool generally used for mobile forensics.

Challenges in the Field:

• Encryption: Encryption plays a major challenge as the encrypted data requires specialized techniques and tools for decryption.

• Anti-Forensic Techniques: Anti-Forensics techniques play a major challenge as the criminals often use anti-forensic methods to cover their tracks, making it challenging to get the digital evidence.

• Data Volume and Complexity: The large volume of digital data and the diversity of various devices create challenges in evidence collection and analysis.

The Future of Digital Forensics: A Perspective

‍With the  growth of technology and the vast presence of digital data, the challenges and opportunities in Digital Forensics keep on updating themselves. Due to the onset of new technology and the ever growing  necessity of cloud storage, mobile devices, and the IoT (Internet of Things), investigators will have to develop new strategies and should be ready to adapt and learn from the new shaping of the tech world.

Conclusion:

‍Digital Forensics is an essential field in the recent era for ensuring fairness in the digital era. By collecting, inspecting, and analyzing the digital data, the Digital Forensics investigators can arrive lawfully at  the prosecution of criminals and the settlement of civil disputes. Nowadays with technology on one hand progressing continuously, the discipline of Digital Forensics will certainly become even more pivotal in the case of investigations in the years to come.

Introduction

Cybersecurity threats have been globally prevalent for quite some time now. All nations, organisations and individuals stand at risk from new and emerging potential cybersecurity threats, putting finances, privacy, data, identities and sometimes human lives at stake. The latest Data Breach Report by IBM revealed that nearly a staggering 83% of organisations experienced more than one data breach instance during 2022. As per the 2022 Data Breach Investigations Report by Verizon, the total number of global ransomware attacks surged by 13%, indicating a concerning rise equal to the last five years combined. The statistics clearly showcase how the future is filled with potential threats as we advance further into the digital age.  

Who is Okta?  

Okta is a secure identity cloud that links all your apps, logins and devices into a unified digital fabric. Okta has been in existence since 2009 and is based out of San Francisco, USA and has been one of the leading service providers in the States. The advent of the company led to early success based on the high-quality services and products introduced by them in the market. Although Okta is not as well-known as the big techs, it plays a vital role in big organisations' cybersecurity systems. More than 18,000 users of the identity management company's products rely on it to give them a single login for the several platforms that a particular business uses. For instance, Zoom leverages Okta to provide "seamless" access to its Google Workspace, ServiceNow, VMware, and Workday systems with only one login, thus showing how Okta is fundamental in providing services to ease the human effort on various platforms. In the digital age, such organisations are instrumental in leading the pathway to innovation and entrepreneurship. 

The Okta Breach

The last Friday, 20 October, Okta reported a hack of its support system, leading to chaos and havoc within the organisation. The result of the hack can be seen in the market in the form of the massive losses incurred by Okta in the stock exchange. 

Since the attack, the company's market value has dropped by more than $2 billion. The well-known incident is the most recent in a long line of events connected to Okta or its products, which also includes a wave of casino invasions that caused days-long disruptions to hotel rooms in Las Vegas, casino giants Caesars and MGM were both affected by hacks as reported earlier this year. Both of those attacks, targeting MGM and Caesars’ Okta installations, used a sophisticated social engineering attack that went through IT help desks.

What can be done to prevent this? 

Cybersecurity attacks on organisations have become a very common occurrence ever since the pandemic and are rampant all across the globe. Major big techs have been successful in setting up SoPs, safeguards and precautionary measures to protect their companies and their digital assets and interests. However, the Medium, Mico and small business owners are the most vulnerable to such unknown high-intensity attacks. The governments of various nations have established Computer Emergency Response Teams to monitor and investigate such massive-scale cyberattacks both on organisations and individuals. The issue of cybersecurity can be better addressed by inculcating the following aspects into our daily digital routines: 

• Team Upskilling: Organisations need to be critical in creating upskilling avenues for employees pertaining to cybersecurity and threats. These campaigns should be run periodically, focusing on both the individual and organisational impact of any threat.  
• Reporting Mechanism for Employees and Customers: Business owners and organisations need to deploy robust, sustainable and efficient reporting mechanisms for both employees well as customers. The mechanism will be fundamental in pinpointing the potential grey areas and threats in the cyber security mechanism as well. A dedicated reporting mechanism is now a mandate by a lot of governments around the world as it showcases transparency and natural justice in terms of legal remedies.  
• Preventive, Precautionary and Recovery Policies: Organisations need to create and deploy respective preventive, precautionary and recovery policies in regard to different forms of cyber attacks and threats. This will be helpful in a better understanding of threats and faster response in cases of emergencies and attacks. These policies should be updated regularly, keeping in mind the emerging technologies. Efficient deployment of the policies can be done by conducting mock drills and threat assessment activities.  
• Global Dialogue Forums: It is pertinent for organisations and the industry to create a community of cyber security enthusiasts from different and diverse backgrounds to address the growing issues of cyberspace; this can be done by conducting and creating global dialogue forums, which will act as the beacon of sharing best practices, advisories, threat assessment reports, potential threats and attacks thus establishing better inter-agency and inter-organisation communication and coordination.  
• Data Anonymisation and Encryption: Organisations should have data management/processing policies in place for transparency and should always store data in an encrypted and anonymous manner, thus creating a blanket of safety in case of any data breach.
• Critical infrastructure: The industry leaders should push the limits of innovation by setting up state-of-the-art critical cyber infrastructure to create employment, innovation, and entrepreneurship spirit among the youth, thus creating a whole new generation of cyber-ready professionals and dedicated netizens. Critical infrastructures are essential in creating a safe, secure, resilient and secured digital ecosystem. 
• Cysec Audits & Sandboxing: All organisations should establish periodic routines of Cybersecurity audits, both by internal and external entities, to find any issue/grey area in the security systems. This will create a more robust and adaptive cybersecurity mechanism for the organisation and its employees. All tech developing and testing companies need to conduct proper sandboxing exercises for all or any new tech/software creation to identify its shortcomings and flaws. 

‍Conclusion 

In view of the rising cybersecurity attacks on organisations, especially small and medium companies, a lot has been done, and a lot more needs to be done to establish an aspect of safety and security for companies, employees and customers. The impact of the Okta breach very clearly show how cyber attacks can cause massive repercussion for any organisation in the form of monetary loss, loss of business, damage to reputation and a lot of other factors. One should take such instances as examples and learnings for ourselves and prepare our organisation to combat similar types of threats, ultimately working towards preventing these types of threats and eradicating the influence of bad actors from our digital ecosystem altogether. 

‍

References: 

• https://hbr.org/2023/05/the-devastating-business-impacts-of-a-cyber-breach#:~:text=In%202022%2C%20the%20global%20average,legal%20fees%2C%20and%20audit%20fees.
• https://www.okta.com/intro-to-okta/#:~:text=Okta%20is%20a%20secure%20identity,use%20to%20work%2C%20instantly%20available.
• https://www.cyberpeace.org/resources/blogs/mgm-resorts-shuts-down-it-systems-after-cyberattack

‍

‍

Introduction

In this age, when our data stands as the key to all resources, espionage has moved from dark alleys and trench coats to keyboards and code. In this era of active digital espionage, where intelligence is stolen through invisible cyberattacks that target computer networks. Cyber espionage and spying have become the most critical threat in the hyper-connected world of today. As governments, corporations, and individuals store an immense amount of confidential information online, the grounds of espionage have shifted from land and sea to the silent realm of cyberspace. 

What is Cyber Espionage? 

Cyber espionage refers to the unauthorised access of confidential data for strategic, political, military, and financial gain, unlike cybercrime, which is mostly about money. Cyber espionage is about gaining information power. The very first documented case dates back to 1986-87, when a group of German hackers breached the US military establishment and the defence systems and sold that stolen data to the Soviets and the KGB. This was the beginning of a new era where classified intelligence could be gathered even without entering a building. 

Cyber espionage is mostly carried out by trained espionage professionals, elite hackers, and corporate spies whose sole purpose is to target the government, research organisations, military establishments, and other critical infrastructures.   

The Objective

The act of Cyber Espionage is being driven by three major objectives, such as;

• Stealing of Intellectual Property- Starting from information and data related to military establishments to pharmaceutical patents, stealing innovation is cheaper than funding R&D. 
• Political and Diplomatic Advantage- As government networks are hacked to access state secrets, negotiation strategies, and classified communications.
• Military Intelligence- Cyber spies also work to steal data on weapons troop movements, defence systems, and war systems, often years before conflict breaks out. 

In a world being shaped by digital power, information is not just about knowledge. Rather, it is all about ensuring dominance. 

The arsenal of modern digital spies is more sophisticated, and most importantly, they are used covertly rather than the spy gadgets that are shown in spy movies. Some of the tactics resorted to by the cyber spies can be recognised as; 

• Phishing Attacks through fake emails that lure victims to click on malicious links or sharing of passwords. 
• Persisting Advanced Threats through long-term stealth attacks in a network for more than a month or a year. 
• Malware and Spyware are invisible software that logs keystrokes, records screens, or steals files silently. 
• Deepfake Manipulations by creating AI-generated fake videos that can influence political developments in the country. 

Anything that makes cyber espionage terrifying is not just the theft, but the fact that it goes undetected. 

What Differentiates Cyber Espionage and Cyber Warfare

Cyber espionage is a silent and stealthy tactic that is carried out with utmost secrecy, being a long-term effort for intelligence gathering. It mostly focuses on the stealing of data, whereas Cyber warfare is an open and destructive tactic that is used to create an immediate and visible impact to create disruption. However, espionage is an act that prepares the battlefield for the warfare of the future. 

Taking instances of real instances of cyber espionage, we can refer to examples such as; 

• Operation Aurora was conducted in 2010, where Chinese Hackers based in Beijing tried to steal IP data from Google and American tech giants. 
• The Stuxnet attack in 2010 was another cyber weapon that was developed to sabotage Iran’s nuclear centrifuges. 
•  SolarWinds Attack of 2020 was an instance of cyber espionage where a supply chain hack was carried out to target multiple US federal government agencies. 

As most of these instances reflect that they were battles without guns, but with the use of codes. Several sources raise the question of whether cyber-attacks can be stopped. The answer lies in the fact that they cannot be stopped completely, but can be minimised to some extent, by developing capabilities to counter and deter cyber-attacks with the help of equal cyber defence capabilities. 

Conclusion 

From the Cold War era to the present Code War, espionage has evolved with technology. An effort that was once taken solely by spies and human assets, with the passing of time enhancement of technologies it is now expanded to malware, phishing, social engineering, and remote digital inflation. In this age of information warfare, espionage is faster, cheaper, and harder to trace than ever before. The enemies of a nation may never cross its borders, but they may already be inside its systems. However, the world has now officially entered a new battlefield, without boundaries, uniforms, and bombs. It is now being fought through bytes, breaches, and invisible enemies.  

References

• https://www.sentinelone.com/cybersecurity-101/threat-intelligence/cyber-espionage/
• https://www.espiamos.com/en/content/espionage-in-the-digital-world-threats-and-opportunities.html
• https://www.apu.apus.edu/area-of-study/information-technology/resources/what-is-cyber-warfare/
• https://pride-security.co.uk/the-rise-of-digital-warfare-understanding-the-evolution-of-cyber-espionage/

‍