Table of Contents  (Contents updated on 29 Oct, 2008)

Approx page count: approx. 220

COMPUTER FRAUD, CRIME AND HACKING

SECURITY THEORIES
THE COMPUTER SYSTEM ITSELF AS LARGELY AN UNTRUSTED SYSTEM
DEFENSE IN DEPTH
VULNERABILITIES
SECURING SYSTEM AND DATA
SECURITY MEASURES

STANDARDS, GUIDELINES AND LAWS

TCP/IP SPECIFIC SECURITY RISKS

PROTECTION OF INFORMATION ASSETS INFORMATION ASSETS DEFINED
DATA CLASSIFICATIONS AND LAYER OF RESPONSIBILITIES
SECURITY POLICY
EFFECTIVE SECURITY PRACTICES
SECURITY AWARENESS TRAINING
CONSEQUENCES OF VIOLATIONS
SECURITY MODELS AND MODES OF OPERATIONS
EVALUATION & CLASSIFICATION
DEVISING YOUR OWN CLASSIFICATION SCHEME

IS CONTROLS
CONTROL MODELS
 

COMPUTER FORENSICS
THE PRIMARY GOAL
EVIDENCE COLLECTION AND SUBMISSION
DEFAMATION OF CHARACTER
TYPES OF EVIDENCE AND THE TOOL(S) TO USE

IT STRATEGIC PLANNING, AUDITING AND GOVERNANCE
IT STRATEGIC PLANNING
IS GOVERNANCE
IS AUDITING
INFORMATION RETENTION & DISPOSAL PROCEDURES

OVERVIEW OF BASIC COMPUTER TECHNOLOGIES

EXAMPLES OF COMMON INTERNET FRAUD SCHEMES

88 Review Questions

View the TOC (in Flash format) here.

If any of the TOC files (in Flash format) fails to load directly into your browser, please right click on the link, then choose SAVE AS, and save the .swf file to your "My Documents" folder. You may then open it locally without any problem.

SAMPLE TEXT on Computer Fraud, Crime and Hacking

Computer fraud can be described as any defalcation or embezzlement achieved through tampering with computer items such as programs, data files, equipment, media ..etc which would result in losses. Access to the computer takes place with the intent to run a fraudulent scheme. Proof of access with fraudulent intent rather than taking things (money, information…etc) away is the emphasis here. In other words, this is sort of a legal principle primarily against access with malicious intent.
 

Computer crime could be different. Those who have authorized access would not come under the law against access. Manipulation or corruption of program or data could be independent of fraudulent schemes and might not be classified as vandalism since the property involved is NOT physically tangible. It may be more accurate to think of computer fraud as Computer-Assisted Crime as it involves the use of computers for evil purposes.

NOTE: In a computer crime, computer can be a means or a target object. In a computer assisted crime, however, computer is primarily a means.


Rusch describes Internet fraud ass a form of white-collar crime whose growth may be as rapid and diverse as the growth of the Internet. According to him, the term "Internet fraud" may be broadly defined as any fraud committed through or with the aid of Internet-related communications. He believes that the growth of Internet fraud is outpacing peoples' understanding of the problem .
 

According to Legal-Definitions.com, fraud is defined “as a deception deliberately practiced to secure unfair or unlawful gain” , which could be a serious crime in some states (for example, fraud in Arizona is classified as class 2 felony and is defined by statute as “any person who, pursuant to a scheme or artifice to defraud, knowingly obtains any benefit by means of false or fraudulent pretenses, representations, promises or material omissions”). The words “deliberately” or “knowingly” spelled out the importance of the intention involved regardless of exactly what have been done to implement the fraud.

NOTE: The US DOJ defines "Internet fraud" as any type of fraud scheme that uses one or more components of the Internet to present fraudulent solicitations to prospective victims, to conduct fraudulent transactions, or to transmit the proceeds of fraud to financial institutions or to other connected with the scheme.


Another word which is often used interchangeably with fraud by the online communities is “scam”, which means a dishonest scheme for making money . Strictly speaking, “scam” and “fraud” do not share exactly the same definition. However, from a victim’s point of view, between the two the difference is not significant, as long as the one who makes money out of it has been dishonest intentionally.

NOTE: According to Rusch, Internet fraud schemes typically employ psychological influence techniques in the forms of E-mail and Web site scams, Online auctions, Securities and other investment schemes. The NACHA Internet Council has a publication titled "Internet Payments Fraud" white paper, which identifies and catalogs the various types of Internet-related fraud, such as transaction-level fraud, merchant-level fraud, and identity theft fraud.


Hacking is the act of penetrating into computer systems without proper authorization – a form of computer intrusion. There are two types of hacking. Unethical hacking is seen as evil – it is attempted to either steal information or cause troubles on the part of the victims. Ethical hacking, on the other hand, is basically penetration testing.

NOTE: You may think of a penetration test as a method of evaluating the security of a computer system or network through simulating an attack by a malicious hacker (source of threat). An ethical hacker (aka whitehat hacker) does not perform questionable activities. A grayhat hacker sometimes does. A cracker ALWAYS does.


From a fraud examination perspective, try to think of hacking as a technical means to commit computer fraud. We will go through the possible technical options, and from there you can tell what is most likely to produce fraud and what is not, basing on the unique fraud scenarios you are facing.