Mobile device usage has skyrocketed in enterprises and so have the risks. Eric Vanderburg and Trevor Tucker discuss the evidentiary value of mobile forensics, its limitations, and how cybersecurity can ensure the processes, procedures, and controls necessary to protect mobile devices and organizational data. This helps companies and attorneys to be better prepared for investigations and associated legal implications of mobile use in the enterprise.

1. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Mobile Forensics and
Cybersecurity
ERIC VANDERBURG
VICE PRESIDENT, CYBERSECURITY
TCDI
TREVOR TUCKER
DIGITAL FORENSIC ANALYST
TCDI

2. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
About Us
TCDI founded in 1988
Microsoft Certified Partner since 2003
Services include:
◦ Digital forensics
◦ Cybersecurity
◦ eDiscovery
Minority owned enterprise

3. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Over 40 certifications
Published author
Licensed private investigator
18 years in cybersecurity
Specializations include:
Risk management
Governance and compliance
Security strategy
GIAC Certified Forensic Examiner
AccessData Certified Examiner
Licensed private investigator
Specializations include:
Forensic analysis
Forensic investigation
Incident response
TREVOR TUCKER
DIGITAL FORENSIC ANALYST
ERIC VANDERBURG
VICE PRESIDENT, CYBERSECURITY

4. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Mobile Phone Forensics

5. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Reasons for Phone Collection
Theft of
Intellectual
Property
Divorce
Wrongful
Termination
Sexual
Harassment
Workers
Compensation
Tracking
Location
Traffic
Incidents
Child custody

6. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Who’s Phone is it?
Company Issued
• Legal rights to phone and
contents
• Easier to access and analyze
• Prevent data loss or destruction
Personal (BYOD)
• May require subpoena
• May lack direct access to phone

7. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Analysis considerations
Chain of Custody
Forensic Tools
Knowledge/Experience
Detailed Report
Expert Witness

8. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Preservation Requirements
Physical Access to Mobile Device
Passcode
Backup password for iPhones
Time

9. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
What Can Be Collected
Contacts & Call Logs Text Messages /
Chats
Voice Mails Emails Geo Tags / Location
Information
Passwords Installed
Applications
Media (Pictures,
Video & Audio)
Internet Activity Social Media

10. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Reporting
Level of detail
Specific Artifacts
Specific Timeline
Key words
Format
◦PDF
◦HTML
◦Excel

11. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.

12. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.

13. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.

14. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Information from Providers
Subpoena Required
Location Data from Cell Towers
Additional Call Logs
Billing Records

15. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Mobile Device Security

16. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Mobile in the Enterprise
93% have mobile devices connecting to their
corporate networks
67% allow personal devices to connect to
corporate networks
66% say careless employees
greater security risk than cybercriminals
*Statistics from the checkpoint mobile
security survey
93% mobile
devices
Careless
employees
Cyber
criminals

17. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Mobile risks
Loss or Theft
• Data breach
• Compromised
credentials
Data Leakage
• Mobile phone
cameras
• Email
• Keylogging
• Entry point to the
enterprise
Compromised
Device
• Malicious app
• Jailbroken device
• Hijacked
authenticator
• Camera/mic
monitoring

18. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Controlling Mobile Risk
Mobile Device
Management
◦Remote wipe
◦Updates
◦Application whitelisting
Policy
◦BYOD
◦Mobile device
◦Acceptable use

19. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Controlling Mobile Risk
Data mapping / data inventory
Awareness training
Incident response planning
Security monitoring

20. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Digital forensics and beyond

21. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Digital
forensics
Computer
forensics
Mobile
forensics
Cloud
forensics
Social Media Email
File Sharing Groupware

22. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Why Digital Forensics?
Reasons to use Digital Forensics
◦ Internal Company Investigations
◦ Alleged criminal activity
◦ IP Theft Investigations
◦ Civil or Regulatory Preservation
◦ Recovery of Accidentally or Intentionally Deleted Data
◦ Deleted is not necessarily deleted
◦ Recovery from Improper shutdowns

23. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Digital Forensics Process
Case Assessment & Planning
Maintaining Chain of Custody
Record Evidence Information
Imaging & Data Collection
Analysis
Exports and Reporting
Expert Testimony

24. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Cybersecurity
Vulnerability
Assessment
Vulnerability
Scanning
Penetration
Testing
Incident
Response
Security
Management
Event
Monitoring
Malware
Protection
Security Awareness
Training
Governance, Risk, &
Compliance (GRC)
Cybersecurity
Assessment
CSO on Demand

25. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Cybersecurity
Demonstrate security values for stakeholders
and customers
Validate security controls
Meet compliance objectives
Protect sensitive corporate and customer data
Gain peace of mind

26. © 2017 Technology Concepts & Design, Inc. All Rights Reserved.
Questions?