The more we move towards the outermost layer so the level of trust decreases, which requires additional security?

Jason O. GovierCCJS 321 # 1The two devices that I have selected are computers and storage devices (i.e. removable media and hard drives), mostly everyone has had experience in working with both devices and from my own experience, these are the two devices that seem to get searched when conducting digital forensics. A computer system has tons of space and areas within the system to hide information. The hardware, software, documents, photos, image files, e-mail and attachments, databases, financial information, Internet browsing history, chat logs, buddy lists, event logs, data stored on external devices, and identifying information about the computer compared to the asset list that a company maintains can all be hide potential evidence (National Institute of Justice, 2008). I did not see this mentioned in the readings, but additionally social media accounts that are logged into the workplace may also be used as possible evidence.Storage devices can be a nightmare for IT personnel and digital forensics, there are so many different types such as removable media (USB’s, Thumb drives, CD’s) and Hard drives internally in a computer system or external hard drives, all of which can store an exceptional amount of data. Evidence such as e-mail messages, Internet browsing history, Internet chat logs and buddy lists, photographs, image files, databases, financial records, event logs, backups, and computer software are just some of the things that can be gathered as evidence (National Institute of Justice, 2008). Some of the challenges IT personnel and law enforcement officers may face when trying to search or gather evidence on a computer system or storage device are violating an individuals fourth amendment rights. For searching these devices IT personnel and law enforcement need to dictate what the need is for searching these items and how it may relate to company owned information or does it justify probable cause at the law enforcement level. Another concern is personal items and effects in the workplace, IT personnel need to have approval form the company to gather evidence and search a co-worker’s workstation and storage devices. Law enforcement officers need a warrant or probable cause, but they must be aware not to violate the Privacy Protection Act. (Pollitt, 2004). Another hurdle can be how an IT personnel or law enforcement secure computers and storage devices, because if they do not handle the evidence properly, it can easily be damaged or erased due to poor handling.Kevin Perez, a privacy lawyer discusses in his journal that employers should verify the following prior to conducting a search at work (Perez, n.d.):verify there is an articulable and legitimate business need for the search.if possible or practicable, obtain written authorization from the employee prior to the search that notes the anticipated scope (e.g., send an email asking for permission to go into a locked office to obtain a file).limit the search to the scope of the consent or the legitimate business need that gave rise to the search.Law enforcement typically need probable cause, but a warrant is even better for conducting a search because now they are legally allowed to conduct that search as signed by a judge. They can specify what they are looking for and even conduct a silent warrant, meaning they do not let the individual in question know they are coming to search. I will also state that as an IT person, there are other ways around Mr. Perez’s recommendations, but the employee needs to be aware of those rights they may be giving up. Typically, if an employer makes an employee sign a user agreement stating their computer or hard drive may be searched for reasons that the company can justify, they should be covered. ——————————————CCJS # 2Week2 Discussion – WoodyContains unread postsThe Evidence to Look For On the DevicesThe two assets described in this scenario are about stolen computers and vehicles, respectively. The two items have distinct features in them that, when stolen, can easily be traced and found. Even if the devices are broken down into various parts, they can easily be linked to the original asset that was stolen. The computer device has distinct features, like the hard drive and processor. The components above have specific serial numbers that only belong to a particular computing device. Vehicles, on the other hand, have elements like license plates, interior decorations of the cars, and some of the engine components may be branded according to the vehicle; hence they can be easily identified if stolen (Jansen, 2010).Limitations to Handle Before Searching Any DeviceThe limitations that come with searching for any devices can be quickly addressed in the following way. We have to consider the limits of the US Fourth Amendment here for both scenarios as a company IT professional and secondly, as a law enforcement officer. Under the US Fourth Amendment, the company can search others on company property as long as there is probable cause and that there are no expectations of privacy from the employee. It would also help if the companies policy or work agreement outlined authorized workspace searches. It would also be safe and within legal limits to ensure the management and HR staff is aware of the search conducted, and that the scope of the search falls strictly within the limits of nature of the search to begin with (probable cause) (Schonrock, 2018).Law enforcement officers, on the other hand, have it a bit easier when it comes to searches, although there are still laws and the constitution to abide by. They can do searches for anything as long as it is found to be reasonable or if there is consent to search. They also can search if something is questionably legal and in plain view (Nolo, 2015). They only need to get a search warrant from a judge to conduct a search. Furthermore, they also have the advantage of having a police badge, which can intimidate people to the consent of a search out of fear where in this case, consent is indistinguishable from coercion (Jacob, 2020). They can potentially use this at their disposal to examine other things if they feel compelled to do so.Private Employees Requirements, Search Policies, and Limitations to Police Searching’sPrivate employees need minimal requirement procedures to enable completion of a private forensic search but have more protection because the public sector or the government does not employ them. The police, on the other hand, are limited to examining the required item or device that their search warrant defines.——————————————425 # 1Week 2 Q1 – BrandyContains unread postsWhat is data remanence? Describe the four different approaches to eliminating data remanence: overwriting, degaussing, encryption, and physical destruction.Data remanence is defined as residual data that remains on storage media after you are done using it (Data Remanence, 2016). If this storage media is not properly destroyed, a malicious individual may be able to access data you thought you deleted. There are four ways to destroy this data:– Overwriting – This is a process in which you overwrite storage media with patterns of new data (zeroization) seven times so that it is now adequate for reuse (Data Remanence, 2016). This is usually done using a tool. Additionally, the storage media should only be reused at the same classification level or lower than the previous data that was present.– Degaussing – This is a process that uses a strong magnetic field to destroy media; it does not work on solid state drives or hybrid drives because they store data with flash memory.– Encryption – This is a process in which you encrypt the data and destroy and not save the symmetric encryption key, however, you must be able to mount the drive.– Physical destruction – This is exactly what it sounds like; physical destruction can include grinding, shredding, chemical alterations, liquefaction/vaporization, incineration, etc. This is the best method to use, however the most expensive.—————————————-425 # 2Domain 3 – Security Engineering – OluwafemiContains unread posts2) In your own words, describe the concept of ring protection. What is the difference between Layering and data hiding?The term ring protection means different levels at which code can be executed and provide restrictions to code such as kernel code, process code, software code e.t.c. “Protection Rings are concentric rings that provide strict boundaries and definitions for what the processes that work within each ring can access and what operations they can successfully execute.” The innermost layer in the rings is the most truster layer, called the kernel area. The more we move towards the outermost layer so the level of trust decreases, which requires additional security? According to Security Architecture and Design, there are four levels to the rings;1) Ring 0: This is the kernel area, which provides the primary functionality to the operating system.2) Ring 1: Contains the kernel extension which is part of the OS3) Ring 2: This is where drivers and utilities operate.4) Right 3: Application and software and user interface operate at this level.Layering is the concept of separating system functionality into a different hierarchy. Each hierarchy has its responsibility and task to carry out within the system operation. Data hiding is the result of layering whereby data is separated into different ring protection resulting in much harden security.