Web Platform for Cyber Forensic Investigation Tools and Corporate Network Integration

by

Swapneel Khandagale | Jul 3, 2020 | in Digital change-maker challenge | Cybersecurity

Define three specific objectives that you would like to achieve with your proposal.

1. The first goal of this initiative is to make these tools accessible to the vast community of cyber forensic professionals from anywhere in the world.


2. The second goal is prevention of proliferation of cyber criminal activities and the profiling of suspected cyber offenders.


3. The third goal is to make the internet (surface web, deep web or dark web) a safer place by enhancing capabilities of the current law enforcement agencies and securing corporate networks via integration of their current security infrastructure with these tools.

What problems (particularly in value chain competitiveness and global disruption) are your community’s stakeholders facing due to the Covid-19 pandemic?

After the COVID-19 pandemic outbreak, increases in coronavirus-related spam and impersonation attack campaigns are exploiting the vulnerability of users working at home, taking advantage of their desire for information about the coronavirus pandemic to entice them to click on unsafe links. Traditional fraudsters are also using spam to offer fake or non-existent goods such as protective masks or COVID-19 cures.

To provide a clear picture of how malicious actors are exploiting those opportunities, the Mimecast Threat Intelligence team analyzed key trends in activity over the first 100 days.

The monthly volume of all the detection categories reviewed increased significantly – by 33% –between January and the end of March 2020.

•Spam/opportunistic detections  (increased by 26.3%)

•Impersonation detections  (increased by 30.3%)

•Malware detections  (increased by 35.16%)

•Blocking of URL clicks  (increased by 55.8%)

Cyber offenders often use VPNs and proxies to hide their identity. It allows them to attack corporate VPNs used for Work from Home, which has increased exponentially during COVID-19 period. Since Work from Home expands the attack surface of a corporate network greatly, corporate networks are at exponentially high risk of being compromised. An attacker almost always would be using VPN to cover up his device’s identity.

The tools mentioned above in the Description of Solution can be integrated with various technologies used in corporate networks such as firewalls and internet activity monitors to prevent a user from connecting to corporate VPN if they are already using another VPN at present.

Similarly, when an employee searches the web for something, it is possible to warn them against a malicious link that pops up on the page they are visiting or against a suspected spam email that somehow entered the mail server using evasion. All this can be done via integration with the aforementioned tools, thus securing the employees and the corporates as a whole.

What minimum viable solution(s) are you proposing to address the challenge(s) in your community?

My overall solution is this platform itself.

Cybersecurity professionals and law enforcement agencies will have tools handy for any situation and from any place.

Corporate networks can be secured by effectively monitoring online activities of employees, warning them of malicious links and malwares on the page they are surfing, detection of intrusion in corporate network and blocking a potential intruder.

This platform’s tools would be vendor independent, that is, they would be able to integrate with security infrastructure provided by all vendors.

Share your story (your narrative)

Let us look at two scenarios here, first of a group of employees of a law enforcement agency and second of a CISO of a big corporate.

1. A group of employees of a law enforcement agency have been tasked with identifying offensive comments and posts against a person on social media. They head to our solution, look for an appropriate tool and enter details such as the social media platform to be scanned, the URL of profile of the victim and the date of posts and comments from which to begin scanning. The tool begins to gather information on all posts and comments, filters out the offensive ones based on a list of words and phrases deemed as offensive in its database. After filtering the posts, it begins to look for those who posted it and acquires information like their platform ID, email, phone number and any other information available on the social media platform. Using the data collected form the tools, the law enforcement agency can take further action in the case.
2. A CISO has been tasked with securing the VPNs being used for Work from Home. The CISO plans to integrate the current corporate firewall with a system to warn the employees against a malicious link on the web page they are visiting. Also, in order to protect against unauthorized access, the CISO has decided to block users chaining proxies in order to access the corporate network via VPN. Since, a common employee will only be using a single VPN which would be provided by the company, most probably only an attacker would be chaining his own proxy with the corporate VPN in order to avoid detection. Our tools prevent this by real time detection of the IP address trying to connect to corporate network and determine whether it belongs to a VPN service by using whois records, a quick scan of well known VPN ports on the IP address and other information freely available on the web.

Please provide any additional relevant information that you would like to share.

Some of these services would be freely available, although with limited functionality. We will make sure to keep updating the tools' performance and accuracy.

This platform will also enable free information sharing on malicious links, pages, malwares etc among the corporates that the tools had found and ensure a healthy and safe web for everyone.