Technology Acceptable Use Policy (AUP)

 

Technology Acceptable Use Policy (AUP) 

FileName: AUP_YourLastName x

You are the owner of a new technology corporation, Acme Technology, LLC., and charged with the responsibility of writing new Acceptable Use Policy (AUP) for the organization.  Based upon  Week 6 readings of Chapters 16, 17, 18 and 19, write the text of the AUP that you propose.  Consider defining major the terms, stating organization policy related to the terms, stating organization penalties for violations, applicable state, and federal laws from which you derive the language.  (See Chapter 4 of the course materials)

You are writing this policy from scratch, please review the following three corporation’s (Amazon, Microsoft and Dell Corporations) samples of AUPs to assist in the process.  

• https://aws.amazon.com/aup/
• https://docs.microsoft.com/en-us/legal/intune/acceptable-use-policy-for-microsoft-intune
• https://www.dell.com/learn/us/en/uscorp1/legal_terms-conditions_dellgrmwebpage/acceptable-use-policy

Chapter 19
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
Forensic Examination of Macintosh Systems

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 19.1 (A) File record interpreted using Norton Disk Editor. (B) Same file record in hexadecimal form.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 19.2 HFS viewed in EnCase showing Catalog file record from Figure 19.1.

Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 19.3 Norton Unerase.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 19.4 IE Cache.waf file viewed using WAFInspec.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 19.5 Entries in a keychain database from Mac OS X system.

Chapter 16
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
Applying Forensic Science to Computers

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 16.1 A selection of storage media and computerized devices.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 16.2 Digital evidence form.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 16.3 Digital Investigation Manager (DIM) from DFLabs used to maintain a database of evidential items and associated information.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 16.4 Comparing bitstream copying to regular copying.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 16.5 Additional class characteristics of EXIF file displayed using ACDSee. The date and time embedded in this file (15:53 on June 11, 2000) is inaccurate because the camera’s clock was not set to the correct time, emphasizing the importance of documenting system time when collecting any kind of computerized device.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 16.6 Fragments of an overwritten JPEG file partially reconstituted by grafting a new header onto the file.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 16.7 Histogram of date-time stamps (created and last modified) showing gaps during suspect’s shifts.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 16.8 Conceptual image of 24-h clocks with MAC times for several days with a line connecting significant events on sequential days.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 16.9 Forensic date and time decoder. These times are generally GMT and must be adjusted for time zones.

Chapter 18
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
Forensic Examination of UNIX Systems

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 18.1 Remote view of a Windows system using FIRE with its VNC connection feature.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 18.2 Conceptual representation of a directory and inode where the file types include regular, directory, symbolic link, and socket.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 18.3 Overview of UNIX file systems.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 18.4 Contents of the root directory’s inode, interpreted as a directory using lde (http://lde.sourceforge.net).
.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 18.5 inode for /etc/passwd.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 18.6 Viewing a Linux system using the Sleuth Kit and Autopsy Forensic Browser.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 18.7 Microsoft NTFS file system and Word embedded metadata viewed PTK.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 18.8 SMART file recovery process saves deleted files onto the examination system for further analysis using other tools.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 18.9 FTK used to view ext2 file system in the file “honeynet.hda8.dd,” available from http://www.honeynet.org/challenge/.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 18.10 Lazarus from the Coroner’s Toolkit used to classify data on a disk and recover deleted data such as the partial image shown here.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 18.11 The Sleuth Kit showing (A) /var/log directory with inode number 502952; (B) information relating to inode number 502952, including the associated block group 31, which can also be obtained using the istat command.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 18.12 A histogram of deleted inodes from a compromised machine showing a spike on November 8 as a result of an intruder’s activities.

Chapter 17
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
Forensic Examination of Windows Systems

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.1 Root directory (skyways-getafix , starts in cluster 184) ® FAT ® data in clusters 184-225 (42 clusters × 512 bytes/clusters = 21,504 bytes).

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.2 Root directory of floppy diskette viewed using X-Ways Forensics.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.3 Example of SleuthKit viewing MFT entry with full details.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.4 Diagram of file with a logical size that is larger than its valid data length, leaving uninitialized space.
.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.5 MFT entry with logical size and valid data length viewed using X-Ways Forensics.
.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.6 Folder entries with 32-bit MS-DOS date-time stamps viewed in X-Ways.
file shares.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.7 DCode used to convert 64-bit FILETIME date-time stamps from their hexadecimal representation.
.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.8 The Sleuth Kit and Autopsy Forensic Browser being used to examine a FAT file system (checkmarks indicate files are deleted).

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.9 DataLifter being used to carve files from two blobs of unallocated space and one blob of file slack from a system.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.10 File slack of a recovered file viewed using EnCase.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.11 Internet Account Manager.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.12 A cookie created by MS Internet Explorer showing recent Mapquest searches viewed using CookieView (http://www.digitaldetective.co.uk).

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.13 FTK showing Word document as e-mail attachments (base 64 encoded).

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.14 Registry showing remote systems recently accessed using Telnet.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.15 Network Neighborhood on a Windows XP computer connected to a home network.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 17.16 Active network file shares.