Anahita Farjamfar

On this anniversary of 9/11, I have published FOUR KEYS of threat analysis. This is based on my 25 years of synthesis of clinical, historical and forensic study. We must embrace these keys to ensure the safety and survival of our democracy, country and our very existence. 🔴 Four Keys of Threat Analysis https://ow.ly/fphh50TlvMY by Tahir Rahman, MD via Psychology Today Predatory vs Affective Violence Affective violence is something most people are familiar with. A bar fight or shoot-out after a brawl is one example (high adrenaline). Another type of violence, called predatory violence, is calm, planned and involves a low level of autonomic activity. This is the type of violence seen in targeted attacks such as mass shootings, terrorism and assassinations. I have developed four keys of threat analysis to guide mental health providers. Fixations Humans develop fixations that we count on for success. Finishing college, remodeling a house, raising an infant or planning a vacation, requires focus. Some might say they become "obsessed" with researching a vacation spot or new kitchen ideas. In another scenario, let's say your uncle believes in conspiracy theories (9/11 was a government plot, JFK was assassinated by the mob, the moon landing was a hoax, etc.) You might joke that he is "delusional." The use of such terms, obsession and delusion are part of our socially accepted vernacular. However, for threat assessment and management, mental health professionals must embrace the proper definitions of delusion, obsession and extreme overvalued belief when conducting a comprehensive assessment... Click to read the rest! #ThreatAnalysis #PredatoryViolence #ViolencePrevention #PsychToday #TargetedAttacks #ExtremeBeliefs

3

Just finished the course “Insider Threat Hunting: Detecting and Responding to Internal Security Risks” by Mike Wylie! Check it out: https://lnkd.in/g4C7Yx4P #insiderthreatdetection #cyberthreathunting.

6

My keynote talk at the INFORMS Security Conference on July 30, 2024 was entitled, “Smarter Decisions for a Secure World: A Roadmap for Operations Research.” The link below contains an outline of my talk and the publications I referenced in my talk for further reading (#ORMS) https://lnkd.in/g3RaXhdM

40

1 Comment

Every crime investigation today, anywhere in the world, has essential requirement of forensic analysis- laptops, mobile phones, other digital devices. Gigabytes and Terrabytes of calls, emails, other stored data which reveals the story untold! Police, ED, CBI and other investigation agencies do not have to bring seized devices back to their offices to analyse data, losing crucial time. On the spot, real-time analysis with mobile forensic tools possible!! Forensic Cybertech, making India's first portable mobile forensic suite under iDEX, Defence India Challenge. Great to see Indian designed product with huge global demand. Well done Forensic Cybertech!! Forensic CyberTech iDEX Defence Innovation Organization ENFORCEMENT DIRECTORATE https://lnkd.in/diMry3Sj

151

23 Comments

https://lnkd.in/gNGcsWhg volume 2 has been officially published!!In this volume, we bring more criminological, victimological, and behavioral aspects to Feminicide forensic investigation; please take a look at Springer Link ✌🏻

32

1 Comment

Back to the basics case study (Part 1): I have decided to do a back to the basics generic case study to emphasize the importance of knowing the basics about digital forensics. Topics includie file systems and how files are stored. No names will be provided during this series and no specific case data will be provided. If this one is well received, I might do another more difficult one. Scenario (this is a generic scenario we see all too often): A hidden camera is located inside of a home. The camera was found in a shared space, but the space is isolated from the rest of the home. Upon a person locating the camera, the suspect (who resided in the home) proceeded to smash the camera. Items seized pursuant to a search warrant were a smashed camera, a microSD card, and a Windows 10 computer. The area inside of the house, where the camera was, had been photographed by investigators. The camera is not operational, but is a basic camera available to purchase on Amazon. A search warrant to search the camera and the microSD was obtained. There was no search warrant to search the computer, at this time. The microSD card was attached to an examining machine via a write blocker and a physical forensic image was acquired. The forensic image of the microSD was analyzed using "forensic" software, including carving for video and image files. Findings: -The microSD was formatted using exFAT filesystem. -Numerous allocated files were located on the microSD. -Most of the files had a naming convention vid_MMDDYY_HHMMSS.mp4. -Other files names with a pattern of what appeared to be initials and a description of the video are also located. -No videos were able to be carved from the microSD but numerous image files were able to be recovered. -There were additional video file names recovered with the initials and description format, but the software was not able to recover the files. Another software was used with the same results. In addition to the file names of deleted files, the file size and MAC (modified, accessed, created) dates were also recovered. -Videos and images of other areas (different from where the camera was located), including a bathroom were located. Questions to consider? (Answers available in another post later in the week.) How would you determine if the date time format of the file name is an accurate date and time? How would you explain the different naming conventions? Why are you able to recover the file names, dates, and size, but not the files themselves? Why did the software only recover images and not videos? What other items would be important to document about the microSD? Is there anything else you would want investigators to do? With what you know now, what could be used as probable cause to attempt to obtain a search warrant for the computer? To be continued... #digitalforensics #computerforensics

12

5 Comments

A collaboration with BSU students for a three-part series of papers on Cybersecurity Risk Quantification. https://lnkd.in/eKbWfX6v #Cybersecurity,#auditing,#CISO, #CISO, #BSU, #RiskAnalysis,#assessments

1

Recently, the Cyber Safety Review Board determined that NIST 800-53 requires updates to address better the risks associated with cloud networking. With Canada's ITSG-33 regarded as the equivalent security framework, does this mean the Government of Canada's baseline information technology security framework insufficiently protects Government networks? #cloud #cloudsecurity #cybersecurity #cyberdefence #ITSG33 #NIST80053 #informationsecurity #canada #innovation #nationalsecurity #enterprise

4

1 Comment

Today, the Canadian Cyber Centre released its National Cyber Threat Assessment 2025-2026. It provides an explanation of the trends in today’s cyber threat landscape and how they may evolve in the coming years. Among our key judgments: ➡️ Canada’s state adversaries are using cyber operations to disrupt computer networks and conduct online information campaigns to divide our society ➡️ The People’s Republic of China's expansive cyber program presents the most sophisticated and active state cyber threat to Canada today ➡️Russia’s cyber program furthers Moscow’s ambitions to confront and destabilize Canada and its allies. ➡️Iran uses its cyber program to coerce, harass, and repress its opponents, while managing escalation risks ➡️ The Cybercrime-as-a-Service business model is almost certainly contributing to the continued resilience of cybercrime in Canada and around the world ➡️ Ransomware is the top cybercrime threat to critical infrastructure Read the full report: https://lnkd.in/gZz9df93

9

Excellent remarks to Senate Committee on National Security, Defence and Veterans Affairs in Canada by Social Media Lab. The conclusion is extremely, and enduringly relevant to New Zealand's information, and media environment as one which closely mirrors Canada's context, but without any comparable official interest, investment or investigation whatsoever into truth decay, (foreign) malign influence operations or information integrity. "In conclusion, we must not underestimate the potential of the Kremlin’s information operations to impact public perception over time. Deplatforming individual sources may not be effective as it could also undermine trust in the government and legitimize censorship. A more nuanced approach should consider the various forms of interference and develop strategies to address them directly. This could include requiring large social media platforms to expand their Trust and Safety teams in Canada, share data with researchers to promote transparency and allow for independent audits. Schools must update digital literacy programs to address emerging challenges such as Generative AI. For the general public, the government should develop PSAs and pre-bunking campaigns to educate Canadians about foreign inference. Aspects of such educational campaigns must focus on and be informed by diaspora communities in Canada, as they are more likely to be targeted by foreign states." These are vital recommendations to consider in concert as bulwarks against what is an unceasing, and increasingly sophisticated assemblage of beguilingly compelling narratives that undermine democracy, eviscerate electoral integrity, and seamlessly cross borders. It's what I study every day.

4

As the use of information technology continues to grow and evolve, and cybertheats keep pace with these changes, a #cybersecurity perspective regarding the global supply chain and #geopolitics becomeincreasingly important knowledge domains.

10

1 Comment

Please join us in welcoming our Security Analyst Co-Op, Orlando Companioni! 📣 Orlando is joining us from Sheridan College, where he worked as a student researcher at the Center for Applied AI (CMI). He is an active CTF Developer for ISS sessions and has experience in both vulnerability management and software development. In the past, Orlando has directed his passion for cybersecurity towards personal projects like Active Directory administration, developing a Python keylogger, and more. #Cybersecurity #CybersecurityServices #PenetrationTesting

66

3 Comments

🔓 Event Announcement! Join us for an exclusive online event, "Unlocking Career Pathways in Cyber Security", on Tuesday, April 30th at 2pm! Whether you're a student, recent graduate, or interested in pursuing a career in cyber security, this webinar is for you. Learn from industry experts and gain insights into the cyber security job market.  Register now for FREE: https://lnkd.in/et73TxZ3 #CyberSecurity #CareerDevelopment #Webinar 

7

🌐 Cybersecurity Alert! Canada’s New National Cyber Threat Assessment 2025-2026 is Here. In a world where our lives are increasingly digital, the Canadian Centre for Cyber Security’s National Cyber Threat Assessment 2025-2026 reveals a complex and rapidly evolving threat landscape that every Canadian should be aware of. 🔍 Key Findings: Ransomware Remains a Top Threat to critical infrastructure, jeopardizing hospitals, transportation, and public utilities. State-Sponsored Cyber Attacks are escalating, with adversaries using cyber operations to disrupt networks, influence public opinion, and pursue political and economic goals. Cybercrime-as-a-Service: Criminal organizations are now offering services to make cybercrime accessible to anyone willing to pay. 🧠 Emerging Threats: AI Amplification: New tools powered by AI could allow cybercriminals to increase the scale and sophistication of attacks. Geopolitical Tensions: Non-state groups inspired by global conflicts are adding to Canada’s cyber risk. 💬 Leaders Speak: "The platforms we rely on to connect with loved ones are now exploited to spread division. It’s up to all of us to protect Canada’s cyber space." – Rajiv Gupta, Head, Canadian Centre for Cyber Security 💪 Canada’s Response: With $917.4M earmarked to strengthen cyber defenses and the formation of the CAF Cyber Command, Canada is ready to confront these threats head-on. But cyber resilience isn’t just for governments—it starts with each of us! ⚠️ Take Action: 🔐 Secure your accounts 🔍 Stay informed on the latest threats 📈 Invest in robust cybersecurity for your business Let's make Canadian cyberspace safer. Join the conversation and help spread awareness. 🌐💻 #CyberSecurityCanada #NationalSecurity #CyberResilience #CanadaCa #NCTA2025 #AI #CyberThreats #StaySafeOnline

1

Canada joins international security partners in release of advisory, guidance on growing cyber security threat to civil society From: Communications Security Establishment Canada News release https://lnkd.in/euaJkipf Ottawa, Ontario – May 14, 2024 The Canadian Centre for Cyber Security, a part of the Communications Security Establishment Canada, joins several global security partners today in warning the public about a growing cyber security threat to civil society organizations and individuals, a community that has been deemed high risk for state-sponsored cyber threats. In a new advisory co-authored by Canada, the United States, Estonia, Japan, Finland and the United Kingdom, cyber security agencies share new details about the ways and means foreign threat actors use for cyber attacks on civil society targets. The high-risk community of civil society organizations and individuals is defined in the report as: nonprofit, advocacy, cultural, faith-based, academic, think tanks, journalist, dissident, and diaspora organizations, communities, and individuals involved in defending human rights and advancing democracy. According to industry reporting shared in the advisory, state-sponsored targeting of these organizations and individuals comes predominantly from the governments of Russia, China, Iran, and North Korea. Those same industry reports highlight the growing and real cyber security threat to civil society, which they describe as high-risk because:  - Civil society organizations and their staff have a high threat of being targeted by malicious cyber attacks – and are known targets -- of state-sponsored cyber actors seeking to undermine democratic values; and - Civil society organizations have a low capacity to defend themselves from such threats, often due to resourcing and the public nature of their work. The advisory warns that the tactics are growing more and more personalized and subversive, with threat actors known to invest significant time and resources to researching each target. The report includes examples of how threat actors may pose as trustworthy sources to trick a victim into interacting with a malicious hyperlink. In another memorable example shared, the threat actors set up trojan-style, fake apps and online app stores housing malicious software – allowing them to access targets’ personal accounts and devices – and even remotely take over a user’s device. The advisory includes prevention tips and resources for civil society organizations, individuals, and software manufacturers. Canadians can stay informed by visiting getcybersafe.gc.ca or cyber.gc.ca for more on how to stay cyber secure.

2

I am pleased to share that our research paper, titled "An Intelligent Approach to Classify and Detect Image Forgery Attacks (Scaling and Cropping) Using Transfer Learning," is now available online. It has been published in the Scopus-indexed International Journal of Information and Computer Security (DOI: 10.1504/IJICS.2024.10062129) Sincere thanks to my co-author Dr. Chandresh Parekh #imageforgery #cybersecurity #deeplearning #transferlearning

59

12 Comments

May 13, 2024 Ontario has just introduced Bill 194, titled An Act to enact the Enhancing Digital Security and Trust Act, 2024 (https://lnkd.in/ec_2ESUa) and to make amendments to the Freedom of Information and Protection of Privacy Act respecting privacy protection measures. The following is a very quick summary of some of the highlights of this interesting bill: The first part of this Bill addresses cybersecurity and the use of (artificial intelligence) AI by public sector institutions in Ontario. The core obligations regarding cybersecurity and AI remain to be set out in regulations. The obligations in the Act are to provide public information and accountability frameworks in accordance with the regulations, and to use and manage the risks of AI systems in accordance with prescribed requirements. The law also anticipates that the use of some AI systems might be prohibited by regulations. It is anticipated in the Bill that any regulations enacted pursuant to the Bill may prescribe compliance with specified technical standards. The first part of the Bill also enables the making of regulations regarding school boards and children's aid societies that will set specific rules for the collection, use, disclosure and retention of the "prescribed digital information relating to individuals under age 18". Technical standards may also be prescribed. Provision is made for the Minister to issue mandatory directives to children's aid societies and school boards respecting digital technology made available for use by children and youths. The second part of the Bill proposes amendments to the Freedom of Information and Protection of Privacy Act (FIPPA) which governs the public sector in Ontario. The amendments include new requirements regarding the reporting of data breaches to the Commissioner. The Bill will also require heads of institutions to ensure that a privacy impact assessment is carried out with respect to any planned collection of personal information. Public institutions will be specifically required to take reasonable steps to protect personal information in their custody or under their control, and breach reporting to the Information and Privacy Commissioner is made mandatory where there is a "real risk that a significant harm to an individual would result". The Bill also provides the Commissioner with the power to review the information practices of an institution upon receipt of a complaint relating to privacy practices. A whistleblower protection provision will be added, and the Bill will specifically empower the Commissioner to consult with other privacy commissioners and to take steps to co-ordinate their activities and engage in joint investigations where appropriate. Florian Martin-Bariteau David Young Law Commission of Ontario Renee Sieber Pamela Robinson Michael Power Jaxson Khan

174

8 Comments

"OSCs must retain artifacts used as evidence for the assessment for the duration of the validity period of the certificate of assessment, and at minimum, for six years from the date of certification assessment as addressed in 32 CFR 170.17(c)(4). The OSC is responsible for compiling relevant artifacts as evidence and having knowledgeable personnel available during the assessment. The organizational artifacts are proprietary to the OSC and will not be retained by the assessment team unless expressly permitted by the OSC. To preserve the integrity of the artifacts reviewed, the OSC creates a hash of assessment evidence (to include a list of the artifact names, the return values of the hashing algorithm, and the hashing algorithm used) and retains the artifact information for six years. The information obtained from the artifacts is an information collection and is provided to the C3PAO for uploading into the CMMC instantiation of eMASS." The above text is from the DoD's June 21, 2024 submission to the Federal Register. It describes the expected information collection level-of-effort for a CMMC Level 2 assessment. Some more information: The DoD expects evidence collection and archival, assessment planning and results, C3PAO records about their assessment staff, and submission of data into CMMC eMASS to take 525 hours on average, per assessed company. This is just the effort related to paperwork. It doesn't cover the time spent interviewing or demonstrating the system. It doesn't cover the time preparing. Bottom line? The DoD seems 𝒅𝒆𝒕𝒆𝒓𝒎𝒊𝒏𝒆𝒅 to get their defense contractors cyber-secure, no matter the cost. They are treating this as seriously as the defenses for our key military and government installations, and looking at a timeline of just a few years to get our manufacturing and military support base resilient to cyber-attack. If you're ready to start working seriously on NIST SP 800-171 and #CMMC compliance, or want to get scheduled for your certification assessment, give my team at Kieri Solutions - Authorized C3PAO a call. We specialize in helping companies become compliant without outsourcing their control of IT to a third party. Read more about the DoD's submission below: https://lnkd.in/eTFi9dVK

51

47 Comments