The effect of ISO/IEC 27001 standard over open-source intelligence

Sources for OSINT

Open-source information (OSINT) has existed since the introduction of mass technology, such as publications and official announcements for intelligence collection, primarily by the military. However, it is now still often used by other organizations. The demand for OSINT overgrew as the Internet spread and made more uncontrolled intelligence sources available (Glassman & Kang, 2012). OSINT may be delivered by printed or interactive channels, such as magazines, television, journals, and, more recently, internet material. Security analysts have used OSINT to complement sensitive information (Best & Cumming, 2007).

The Internet has been a valuable platform for every intelligence analyst owing to Internet filtering, scanning, indexing, and search engines (Appel, 2011). The overwhelming number of citizens have Internet and digital platforms, meaning that many archives of personal minds are preserved in the Internet’s official, semi-public and large websites (Appel, 2011). According to Koops, Hoepman & Leenes (2013), law enforcement authorities mine Facebook and Twitter for intelligence purposes. Online news sites are often tracked to track and deter extremist violence see Fig. 2.

Who needs OSINT?

Open-source intelligence is more often associated with military intelligence and organizations. The OSINT user base is far broader. OSINT is primarily used by large global corporations, banks, and diverse sectors to collect information and market analysis for decision making, strategic advantage, and business security.

• Government/Government bodies, including defence, intelligence, and law enforcement agencies

• International organizations

• Business companies

• Penetration testers, hackers

• Individuals who value their privacy.

Terrorist organizations and black hat hackers

Criminals and black hat hackers use OSINT plans and techniques similar to those utilized by law-abiding people to obtain intelligence on goals before committing a crime. Social engineering attacks begin with adequate data about the goal. The gathered data is utilized to redo the assault as indicated by every individual, expanding the opportunity for effective interruption—the different periods of the Miter ATT&CK digital murder chain.

As shown in Fig. 3, the MITRE ATT&CK kill chain, most cyberattacks begin with a reconnaissance process, including OSINT.

OSINT as a business tool

OSINT is well developed as more private-sector technology and solutions are used. The efficacy and importance of OSINT are no more in doubt; instead, the concern is how effectively it can be integrated into a specialization for security experts in the public and private sectors (Gibson, 2004). Table 1 shows OSINT Source Checklist. Integrating OSINT systems into corporate structures can result in significant gains and improve the organization’s overall effectiveness in responding to internal and external challenges. We may appreciate the significant attributes.

Significant benefits of open-source intelligence

For both types of organizations, the advantages of OSINT are self-evident. The subsequent segment addresses the most significant matters:

1. OSINT is strategically advantageous in contrast to other forms of traditional intelligence collection, such as Signals Intelligence (SIGINT) or Geospatial Intelligence (GEOINT), which have a poor cost of return on investment (ROI). Without spending a lot on consultants and other high-priced tools, businesses with small surveillance expenses may employ OSINT tactics or subsidize it to a third-party provider.

2. OSINT databases are abundant and provide material about almost every topic imaginable and accessed at any time. For instance, a regular Google search just covers the basics of Google’s indexed page material. OSINT uses the site’s three layers (surface, underground, and darknet) to ensure that the quest covers nearly all web material.

3. By doing an OSINT information leakage evaluation, OSINT tools may uncover flaws in IT applications. A company may detect compromised user passwords, accessible ports, vulnerable network networks, and already-in-use expired applications and operating system models.

How Is open-source intelligence used?

Since exploring the fundamentals of Open-source intelligence, we will explore how it is widely utilized in cybersecurity. We commonly use these 2 cases, as shown in Fig. 4:

What constitutes open-source information?

When knowledge or details in total is:

• Intended for a broad audience (e.g., news channels and newspaper contents).

• Open to the public at no charge.

• Open to the public upon paying a premium (e.g., Books, Journals, Magazines, digital libraries).

• Information that could be gathered without a warrant or in breach of a data privacy statute.

• Available through the Surface Web (e.g., social networking sites and all search engines may access), the Deep Web (including historical database information), or the Darknet.

• Information that is discoverable by specialized search engine operators, such as Google dorks or Bing search operators.

• Data available in public meetings/discussions or that is audible to the average listener.

Security controls (Annex A)

ISO 27001’s Annex A, or the controls portion, includes a list of 114 industry-standard protection controls or protections divided into 14 divisions and classified according to the categories listed as shown in Table 2:

Becoming ISO/IEC 27001:2013 Compliant: Who, When, Where, Why, How

• Who: ISO/IEC 27001:2013 ideal for an organization that needs to enhance its knowledge technology by implementing industry-wide best-recognized standards for surveillance?

• When: ISO/IEC 27001:2013 will be introduced and approved at any point. The company can opt to enforce the norm and credential later when regulations need it, raising consumers’ and clients’ confidence in a move at the same time.

• Where: Both organizations can use the definition regardless of whether they are for-for benefit, nonprofit, or public-based entities.

• Why: ISO/IEC 27001:2013 will improve protection by applying it essentially. It lets companies comply with regulations, attracts clients by reassuring them about the protection, lowers expenses, and organizes an efficient framework for data security processes and regulations. See Table 3.

ISO 27001’s advantages

ISO 27001 is one of the most frequently accepted standards for data processing. Globally recognized is certification of the Benchmark by an independent accredited entity. In the last decade, the number of credentials has increased by more than 450%.

By adding the Standard, one can maintain consistency with information security management systems enforced by legislation such as the EU GDPR (General Data Protection Regulation) and the NIS (Network and Information Systems) Regulations. This reduces the level of risks relating to data breaches.

• Ensure the security of your files, regardless of their location

• Risk savings associated with computer management

• Enhance the corporate atmosphere

• Improve the threat resistance

• Anticipate and react to emerging cyber threats

• Comply with statutory requirements.

ISO 27701 privacy regulations

Privacy security in a rising wired environment is a necessary expense. New privacy laws, such as the General Data Protection Regulation (GDPR), enforced by authorities, force businesses to act. ISO specifications such as ISO/IEC 27701 can help the company fulfill specifications and handle privacy threats relating to sensitive details (PII). ISO 27701 Privacy Information Management System (PIMS), expansion to ISO 27001 Information Security Management System (ISMS), will help the organization fulfill compliance standards and handle privacy threats associated with Personally Identifiable Information (PII). Implementing a management framework compatible with ISO/IEC 27701 and ISO/IEC 27001 would allow the business to satisfy GDPR’s privacy and information security standards and other data protection regulations. GDPR allows organizations to take adequate technological and operational steps (including protocols, procedures, and processes) to safeguard their records. Microsoft’s involved committee member.

Julie Brill, Corporate Vice President and Deputy General Counsel for Privacy and Regulatory Affairs at Microsoft, said:

“We thank the ISO/IEC Technical Committee for introducing this innovative privacy standard so that companies of all sizes, territories, and sectors can easily protect and monitor their data. As the next chapter in Microsoft’s dedication to extending protections under the General Data Protection Regulation of the European Union to our customers internationally, Microsoft Azure and Office 365 will enforce the PIMS standard and support our customers and collaborators in implementing this interoperable model.”

Objectives and research question

This analysis discussed the following research question: Will OSINT be used for automated forensic investigation, and is the information gathered permissible as proof in a legal proceeding? To resolve this problem sufficiently, the following sub-objectives should be approached:

• Q.1. Determine what evidence obtained from social media and Open-source intelligence (OSINT) can advise a forensic analysis officer in an investigation.

• Q.2. Develop a system that digital forensic experts may utilize when performing an inquiry that involves using social networking services in part or entirely to collect evidence.

• Q.3. Develop standards on what comprises a social networking platform and the kinds of knowledge or facts accessed from these pages.

• Q.4. Discuss any shortcomings or difficulties discovered by a digital forensic investigator when performing a completely or partially forensic inquiry involving social media platforms.

In answer to the research query, the researcher hypothesizes that the knowledge collected from OSINT has valid significance and may be used to support cyber forensic experts.

Investigative process

In 2001, as part of the DFRWS, a forensic protocol was established that contained the following types of steps that experts believe should be taken while conducting a remote forensic analysis (Palmer, 2001): Casey (2011) updated the most often used steps for performing a thorough automated forensic examination and recommended that the following steps be taken see Fig. 5.

Research strategy

It attempts to illustrate online analysis and gather information research on OSINT and social networking techniques as data. Rather than treating humans as static units, we consider their test subjects that merely respond to stimuli; we have been experimenting on them. Other responses were offered in the report and, for instance, on the subjects of the findings. However, it is all research-based, so there is no way to quantify most of the data. The survey findings were examined, and a first quantitative analysis was undertaken, followed by a qualitative evaluation of the outcomes (Saunders, Lewis & Thornhill, 2009). when phenomena can be viewed as just as themselves, cross-over phenomena can be used for studies or studied over a single timespan (Saunders, Lewis & Thornhill, 2009, p. 155).

Data collection and analysis

An electronic sample of digital forensic professionals delivered the primary data used in the questions used in this research. Participants may participate electronically; much of the survey is completed by email or the Internet. The central part of the survey was developed using rating questions, which are commonly used to solicit views. Using a Likert-style scale, the researcher was able to conduct detailed observations and interviews, the results of which were qualitative. When expanding the questionnaire, respondents were asked to provide an answer or explain each assertion. They were then asked to answer the agreement or disagreement with statements or statements, respectively (Saunders, Lewis & Thornhill, 2009). More questions were asked to obtain additional details when this response was provided to clarify previous answers.

The survey was split into three sections: longitudinal data collection, social network monitoring, and OSINT collection. The survey’s first segment focused on longitudinal results. The details obtained from the questionnaires will provide the researcher with information about the participant’s qualifications, the number of years of experience performing digital forensic investigations, the field they currently operate in, and, eventually, their position in digital forensics. The second segment included concerns about social media use. Participants were asked questions about utilizing social media and how they use it while performing automated forensic investigations. This section is essential for the researcher. The comments can help them gauge the researchers’ understanding of how social networking is used and how users feel during digital investigations. Inquiries inside the third section included OSINT for the third time for the study; survey respondents were asked whether they used OSINT in addition to or whether it was done as part of an automatic investigation. Analysis techniques were derived from the information which was required for OSINT use.

Survey participants

Only digital forensic professionals were included in the study’s sample category. A sample questionnaire was emailed to 35 respondents. This sample population specifically consisted of those who have attended advanced forensics seminars. All of them have already shown their readiness to engage in the survey research. Despite the researcher’s awareness of all respondents, the researcher performed the 20 questionnaires anonymously. Just 9 completed electronic questionnaires were sent out of the original 75 sent. The test sample was entirely voluntary whenever someone got in touch with them via text, they were informed of the following:

• The sample questionnaire will be confidential, and the identity of the applicant will not be revealed in the study;

• They might avoid the research altogether if the questionnaire were too distressing; and

• All participants would obtain the results upon request.

Participants’ demographic information

Tables 4 and 5 show the demographic questions and characteristics of the study population. We had information regarding their educational institution, working area, and the number of years they have been in the field for respondents. They said that they are in charge of a digital forensic project with different degrees and career titles.

In our survey, a various questionnaire was asked to the participants, and some the questions are given below:

Analysis of survey questions

Usage of Social Media to obtain Specific Information On a scale of 5 (strongly agree) to 1, participants were asked to evaluate the extent of their belief that social media sites could help modern forensic investigators recognize certain types of information (strongly disagree).

Responses (n = 9) to whether social networking platforms can help digital forensic investigators obtain specific types of evidence. Participants generally agreed that social networking sites could assist digital intelligence officers in developing all but two kinds of evidence presented (Fig. 6).

• 67% of respondents were unsure if social networking platforms could assist in crime prediction.

• 61% of participants were unsure if social networking platforms could aid in identifying illegal activity.

According to the LexisNexis (2012) Study, the top three applications of social media for criminal investigations are “identification of persons and places, the discovery of criminal behavior, and finally, proof collection” (LexisNexis, 2012).

According to a law enforcement official surveyed by LexisNexis in 2012, social networking sites aided crime prevention. Through launching an inquiry through Facebook, the officer believed they had averted a “Columbine-style shooting.” There was sufficient evidence that the warnings were genuine, and further investigations revealed that a student was in the process of buying weapons and intended to harm others (LexisNexis, 2012).

My social networking sites’ tools

The availability requirements attempted to decide which digital forensics specialists used while conducting social media digital forensic analyses.

Responses (n = 9) to which techniques are utilized when conducting automated forensic investigations via social media. Internet Evidence Finder (IEF) is a proprietary piece of software and, using the information available over the Internet, is effective in restoring thousands of Internet-related objects. And is used by 61% of participants in a poll. IEF is a dependable tool since it can extract information from social networking sites, webmail, online computing, web traffic, and many other sources.

On the Internet, there is a tool for locating evidence. Vulnerabilities in Google The Malthusian theory Network examinations Python scripts for web crawlers Application for searching details using Cacheback Bulk Extractor Google hacking, for example, entails utilizing the Google search engine in conjunction with various search operators that have definitions exclusive to the Google search engine (Long, 2008). When a search operator such as “filetype: pdf” is used, Google can return results that include websites that use the text extension pdf. When doing an Internet search for a particular pdf text, this search is beneficial.

According to Bradbury (2011), search engines are a valuable instrument, and Google hacking is a valuable technique. Another useful Google trick is “cache: website,” which returns a cached version of a website, applicable when searching for an outdated version of a website. Half of those interviewed said they had used Google Hacks. Maltego, an OSINT and forensics app, is used by 44% of respondents (Fig. 7). Maltego is a program that analyzes and visualizes data relationships. Running data from the social networking tool LinkedIn from Maltego, for example, produces results such as memberships in other social networking sites and contact details, depending on which the LinkedIn profile user has supplied this information (Bradbury, 2011). Maltego’s capacity to browse the Internet for important details such as email addresses is another useful function (O’Connor et al., 2010). When a user enters a name and surname into the Maltego email search feature, the site is searched for all email addresses that include the entered name and surname.

Netanalys, a data collection and analysis platform for different Internet browsers, 22% of those surveyed. The program is valuable since it can download Internet history and cache data from a variety of browsers. Python is known as a hacker’s programming language because of its ease of use. TIC serves as an excellent software for the implementation and dissemination of specific tactics. It is often considered compliant with various specialized platforms, allowing every army mod to build its levels or mods (O’Connor, Stewart & Smith, 2013). According to respondents, one-third of those who use Python for automated tools in-network investigation use social networking as their primary method. As done in a script that uses the Twitter APIs for data recovery in digital forensics, retrieve helpful knowledge is used for testing and scraping Twitter as the details contained in Twitter data extraction buttons (API).

Python scripts may be used to retrieve any content, including users’ tweets and retweets and geographic position (O’Connor, Stewart & Smith, 2013). In Appendix, there is a Python script for the python method that searches Twitter for the positions of new and retweets. Crawdads may also be referred to as web spiders or scrapers, based on the feature under consideration. Clough defines search engines as browser software that reviews different websites, retrieves details, downloads files, positions them in a database section, and stores all information on internet pages.

Web crawlers, like web spiders, are often used by hackers to obtain email addresses from the Internet. Only 1 in 7% of respondents found evidence of web-seeking software to be relevant during a digital forensic investigation. Cashback is an internet investigation program for multilingual web searching, analysis, originally called Expando, is now known as Cacheback, and can even look for security details in web browsers. XIT can retrieve the background of several web browsers and caches it to be presented on a new page and helps the investigator display the Internet history connected to it. Approximately two-in-of-ten respondents answered, “expand upon,” or two out of every 10 responded, “add to” An email address and username.

URL gathering utility is a function that can also extract account information for automated forensic purposes. The bulk extraction tool may also accept data from a hard disk (an investigator’s hard drive, a memory card, or camera) and media connected to it. Bulk extractor’s most significant power resides in its ability to inspect numerous drives or images, which is why the application uses multiple scanners (Garfinkel, 2013). only 11% of the respondents said they used a bulk extractor when involved in automated forensic examination.

Although there are several methods of using Twitter’s open-source elements, you can make an application around a system that meets the specifications of the Twitter searchable terms of use so long as the original developer stays in compliance with the terms of use. Malte is proficient in API (or application programming interface) requests. The functionality in Malgo helps anyone find tweets on the Internet by providing Malte consumers with the user’s current location, tweet data, and retweet information. Search results for an individual or the Twitter photos, media often apply to their Twitter account are made available for Malgo’s followers through the platform’s image search feature. The API that allows users to retrieve tweets and locations also creates scripts that retrieve tweets and positions. Only 6% of respondents mentioned they have ever searched social network applications in their social networking investigations (Fig. 8).

The most famous social networking sites

How do prosecutors use social media to increase their understanding of the case’s background to find and obtain and organize help material for their investigative details? Respondents (n = 9) were asked which social network networks they most commonly utilized while conducting an inquiry (Fig. 9).

A total of 83% of respondents use LinkedIn to collect evidence for an inquiry. Aside from the obvious things, including an email address, geolocation, and marital status, a LinkedIn profile provides a wealth of details regarding the person. LinkedIn is primarily a professional networking platform; it includes details about an individual’s job title, previous employer, and educational institution. Additionally, it suggests potential associates (Bradbury, 2011).

As of July 27, 2014, there were roughly 1.32 billion Facebook members, with an average of 4.75 billion things posted every day, according to Facebook’s main facts12. A total of 78% of those polled claim they use Facebook for study purposes. When performing interviews for the (LexisNexis, 2012) report, law enforcement officers found that the most often used personalized social networking platforms, such as Facebook and YouTube, are personal social networking accounts. LexisNexis (2012), 56% of respondents used Twitter in their inquiries. Twitter can show who follows a particular user associated with a Twitter handle and follows the Twitter account itself. This information is especially beneficial if an individual’s interactions with other individuals or organizations are being monitored. Twitter was used in 2011 to rally a group of Twitter users to plead for assistance in sweeping up the streets after the 2011 London Riots. YouTube is a popular website for video sharing where 22% of users registered. A participant in the LexisNexis (2012) police study confirmed that YouTube helped in the active arrests of gang members have produced a recruitment video and increased gang-related activity Thesaurus.

Instagram is a social networking site that a web application on smartphones can access. Users may use Instagram to post videos and images. Users of Instagram would also share photographs and videos on Facebook and Twitter; 17% of respondents use Instagram for testing purposes. Eleven percent of respondents use Foursquare, a social networking platform that enables users to log in and share their current position with others. Google Plus is a social networking site run by Google. Google Plus, which 6% of respondents use, offers a network for networking and storage. Pinterest is a social networking site that 6% of respondents utilize. Individuals can build and post Pinboards, which are digital bookmarks, on Pinterest. A Pinterest account can be connected to a current Twitter or Facebook account, allowing users to update their Facebook and Twitter mates if they add a new pin to their Pinboard.