Investigation Plan
AMS corporate assets and how we will conduct and review each asset AMS is a marketing company that suspects an internal skimming operation taking place amongst their employees. This means that they believe that an internal threat is the cause of this operation. Al internal threat is “any instance of a user misusing resources, running malicious code or attempting to gain unauthorized use of another user’s account, unauthorized use of system privileges, and execution of malicious code that destroys data. Most significant internal threats may include an otherwise authorized system administrator who performs unauthorized actions on a system” (FCC, 2001). I have been contracted to find out if this is actually taking …show more content…
We will need to determine: o If the suspected incident is real o If money, data, or property has been stolen from the company o If this skimming operation has affected the company in any way o If the skimming operation took place on the company’s systems o If we can mitigate the operation quickly and efficiently o Determine the nature of the operation o If the operation is still taking place
Task 6: Once we gather all of the pertinent information we will determine the level of this operation.
Task 7: Once this is done we will determine how we are going to address the operation. This has to be done properly because this is an undercover investigation and we cannot afford anyone outside of the parties who are already aware of this investigation finding out about us and our motives.
Task 8: We will use our toolkit and other forensic tools to investigate, collect, and analyze the evidence. This would include analyzing the logs that were retrieved from suspected employees, call logs, email accounts, as well as intrusion detection …show more content…
The following is a time estimate for each task that will need to be conducted during this investigation:
Day 1: Collect requirements from company
Day 2: Gather background information on the skimming operation
Day 3: Contact necessary parties (VP of IT and Comptroller)
Day 4: Determine plan, begin initial investigation, and determine the level of the investigation
Day 5-11: Collect and analyze evidence
Day 12-16: Complete assessment of investigation
Day 17-21: Report and brief company on findings
Potential Risks and challenges: This investigation poses numerous risks that could present to be a challenge. Some of these risks include: confidentiality, leadership insider threats, external threats, broken cover, and data leakage. One major risk would be ensuring that no one finds out that an investigation of taking place. If people find out that an investigation is taking place they may spread the word to other personnel and this could cause the evidence that we collect to be inaccurate. Data could be deleted, files could be destroyed,