Unit IV: Modus Operandi of Cyber Crimes and Frauds - Detailed Notes
1. Modus Operandi of Cyber Crimes and Frauds
The term 'Modus Operandi' refers to the specific methods and techniques used by cybercriminals to commit
crimes. It involves planning, executing, and covering up digital attacks. Examples include phishing (sending
fake emails to obtain sensitive data), ransomware (locking data and demanding payment), data diddling
(altering data before processing), salami attacks (small amounts siphoned off multiple transactions), email
bombing, and spoofing. Understanding these techniques helps in designing effective cybersecurity measures.
2. The Fraud Triangle
The Fraud Triangle is a model used to explain why individuals commit fraud. It includes:
- Pressure: A personal or financial problem that motivates the person to commit fraud.
- Opportunity: The situation that enables fraud to occur, often due to weak internal controls.
- Rationalization: The justification or mindset that the crime is acceptable (e.g., 'I deserve it').Organizations
can reduce fraud by addressing these three factors through better monitoring, support systems, and strong
ethical cultures.
3. Fraud Detection Techniques
Detecting fraud involves a combination of manual review and automated tools. Techniques include:
- Log File Analysis: Checking server and application logs for anomalies.
- SIEM (Security Information and Event Management): Real-time analysis of security alerts generated by
applications.
- Honeypots: Decoy systems designed to lure attackers and study their behavior.
- Behavioral Analytics: Observing user behavior to detect unusual activity.
- Digital Forensics: Collecting and examining digital evidence to identify and trace cybercriminals.
4. Countermeasures
Countermeasures are steps taken to prevent, reduce, or respond to cyber threats. These include:
- Technical: Firewalls, antivirus software, multi-factor authentication, encryption.
- Organizational: Regular audits, cyber awareness training, employee monitoring, access control policies.
- Legal: Implementing cyber laws and ensuring that offenders are prosecuted to deter others.
5. Intrusion Analysis
Intrusion analysis is the process of investigating unauthorized access to a network or system. The goal is to
understand how the attack occurred, identify affected assets, gather evidence, and recommend actions. It is
a critical step in cyber incident response and forensic investigations. Intrusion analysis helps improve
defenses by revealing system vulnerabilities and attacker tactics.
6. Intrusion Analysis as a Core Skill Set
Cybersecurity professionals must possess intrusion analysis skills to:
- Reconstruct timelines of cyberattacks.
- Understand attacker motivations and methods.
- Identify vulnerabilities in systems.
- Collect evidence for legal proceedings.
These skills are essential for incident response teams, forensic analysts, and security engineers.
7. Methods of Performing Intrusion Analysis
There are various ways to conduct intrusion analysis:
- Passive Log Review: Analyzing historical data to find anomalies.
- Real-Time Monitoring: Using tools like Wireshark to capture and inspect traffic.
- Threat Intelligence Feeds: Accessing databases of known malware and attack patterns.
- Signature-Based Detection: Identifying known malware based on code signatures.
- Behavior-Based Detection: Identifying previously unknown threats through unusual system or user behavior.
8. Intrusion Kill Chain
The Intrusion Kill Chain is a model that describes the steps of a cyberattack:
1. Reconnaissance: Gathering information about the target (e.g., social media, emails).
2. Weaponization: Creating malware or exploit tools.
3. Delivery: Sending the malware via email, USB, or link.
4. Exploitation: Activating the malware by exploiting a vulnerability.
5. Installation: Installing a backdoor or malware.
6. Command & Control (C2): Establishing remote control over the system.
7. Actions on Objectives: Executing the attack's goal - data theft, destruction, spying, etc.
Interrupting the kill chain early can prevent major damage.
9. Passive Discovery and Future Threat Detection
Passive discovery involves reviewing past activities, system logs, and audit trails to find indicators of
compromise (IoCs). This helps detect if an attack has occurred and predict potential threats by recognizing
patterns. Tools like EDR (Endpoint Detection and Response) provide real-time data to proactively identify
threats and mitigate future risks.
10. Denying, Delaying, and Degrading Attacks
These are strategies to reduce the effectiveness of cyberattacks:
- Deny: Use strong authentication, access controls, and firewalls to block unauthorized access.
- Delay: Implement timeouts, rate limiting, and CAPTCHA to slow attackers.
- Degrade: Confuse or mislead attackers using deception technologies, like fake servers or data.
These steps help reduce the impact of attacks and provide more time for detection and response.
