Cybersecurity, Ethical Hacking and Digital Forensics Foundations

Introduction and Context

Modern organisations depend on interconnected information systems, cloud platforms, mobile devices, industrial systems and third-party services. This dependence creates value but also creates opportunities for misuse. Cybersecurity is therefore not merely a technical activity; it is a socio-technical discipline concerned with protecting information, systems, people and institutional trust.

Ethical hacking and digital forensics are closely related but distinct professional practices. Ethical hacking seeks to identify weaknesses before malicious actors exploit them. Digital forensics seeks to identify, preserve, examine and interpret digital evidence after—or sometimes during—an event. Incident response coordinates the containment and recovery of an incident, while red teaming evaluates the organisation’s ability to resist realistic adversarial behaviour. Together, these activities support prevention, detection, response, recovery and learning.

A postgraduate student should understand not only what tools do, but also why a particular method is appropriate, what assumptions it makes, what evidence it produces and what legal or ethical limits apply.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain confidentiality, integrity, availability, authenticity and accountability as security principles.
2. Classify threat actors, motivations, capabilities and targets.
3. Distinguish assets, attack surfaces, vulnerabilities, exploits, threats, risks and indicators.
4. Describe cybercrime and the legal, ethical and governance issues surrounding security testing.
5. Differentiate vulnerability assessment, penetration testing, ethical hacking, red teaming, incident response and digital forensics.
6. Classify digital evidence and explain principles of preservation, integrity and chain of custody.
7. Relate indicators of compromise and indicators of attack to detection and investigation.
8. Apply a defensible workflow to a realistic security incident.

1. The Security Problem as Risk Management

Security protects assets against events that may cause harm. An asset may be data, software, hardware, a service, a person, an organisation’s reputation or a critical business process. A threat is a potential cause of an unwanted event. A vulnerability is a weakness that can be exploited. An exploit is a method, code sequence or operational technique that takes advantage of a vulnerability. Risk is the possibility that a threat will exploit a vulnerability and produce an adverse consequence.

A useful conceptual model is:

Likelihood represents the estimated chance or frequency of an adverse event, and impact represents the magnitude of harm if it occurs. This expression is a management model rather than a universal physical law. Organisations may use qualitative scales, ordinal scores or quantitative estimates. Multiplying ordinal labels can create a misleading sense of precision; risk ratings should therefore be supported by evidence and documented assumptions.

Risk treatment generally involves avoiding, reducing, transferring or accepting risk. Controls may be preventive, detective, corrective, deterrent or compensating. For example, access control is preventive, logging is detective, backup restoration is corrective, warning banners may be deterrent, and manual review may compensate for a missing automated control.

2. Core Security Principles

2.1 Confidentiality

Confidentiality limits information access to authorised subjects and processes. Encryption, least privilege, segregation and data classification support confidentiality. Confidentiality is not identical to secrecy: an organisation may legitimately disclose information to an authorised regulator while still maintaining confidentiality against unauthorised parties.

2.2 Integrity

Integrity concerns accuracy, completeness and protection against unauthorised or improper modification. Hashes, digital signatures, access controls, version histories and write-protected storage can support integrity. A hash can show that two files have the same digest under a specified algorithm, but a hash alone does not prove who created a file or whether the original file was trustworthy.

2.3 Availability

Availability means that authorised users can access systems and information when required. Redundancy, capacity planning, resilient architecture, backups, patching and denial-of-service protection contribute to availability. Availability is often expressed through service-level objectives, recovery time objectives (RTOs) and recovery point objectives (RPOs).

2.4 Authenticity and accountability

Authenticity provides confidence that an entity, message or artefact is genuine. Authentication mechanisms include passwords, certificates, tokens and biometrics. Accountability links actions to responsible identities through logging, attribution and governance. Non-repudiation is a stronger claim that a party cannot reasonably deny an action; it depends on technical controls, key management, identity assurance and legal context.

2.5 Defence in depth and zero trust

Defence in depth uses multiple independent or partially independent safeguards so that failure of one control does not automatically produce compromise. Zero trust is an architectural approach based on continuous verification, explicit authorisation and limited implicit trust. It does not mean that trust is mathematically eliminated; rather, trust decisions are made explicitly and repeatedly based on identity, device, context and policy.

3. Threat Actors and the Threat Landscape

Threat actors differ in capability, resources, motivation, access and tolerance for detection. Categories overlap, and attribution is difficult because attackers may impersonate others or use rented infrastructure.

Threat modelling examines what must be protected, who may attack it, how an attack could occur and which controls reduce exposure. Frameworks such as STRIDE classify classes of design threats, while attack trees represent how an adversary might achieve a goal. MITRE ATT&CK is a knowledge base of adversary tactics and techniques used for defensive analysis and emulation. These frameworks organise reasoning; they do not replace organisation-specific evidence.

4. Attack Surfaces and Vulnerabilities

An attack surface is the collection of reachable points through which an unauthorised action may be attempted. It includes internet-facing applications, APIs, remote access services, endpoints, wireless networks, identities, cloud configurations, software dependencies, physical facilities, removable media and human processes. The attack surface changes whenever systems, suppliers, accounts or business processes change.

Exposure and vulnerability are not synonymous. An exposed service may be securely configured, while a vulnerable component may not yet be reachable by an attacker. A vulnerability becomes more significant when it is reachable, exploitable, valuable to an attacker and insufficiently controlled.

Examples include:

• software defects such as injection, memory errors or insecure deserialisation;
• weak authentication, excessive privileges and poor credential management;
• insecure cloud storage or network segmentation;
• unsupported systems and unpatched dependencies;
• social-engineering susceptibility and inadequate procedures; and
• physical access weaknesses.

A vulnerability assessment identifies and prioritises weaknesses. A penetration test validates selected weaknesses through controlled exploitation. Neither activity proves that a system is secure: testing is limited by scope, time, credentials, test conditions and the tester’s methods.

Exploitability and responsible testing

Testing must be authorised, bounded and monitored. A written rules-of-engagement document should specify target systems, dates, allowed techniques, prohibited actions, emergency contacts, data-handling requirements and reporting expectations. Destructive actions, persistence, denial-of-service testing and access to unrelated personal data require exceptional justification and explicit approval.

5. Cybercrime and Professional Ethics

Cybercrime includes offences in which digital systems are the target, instrument or environment of the crime. Examples include unauthorised access, malware distribution, identity theft, online fraud, ransomware, unlawful interception, data theft and abuse of computer resources. Applicable law varies by jurisdiction, and cross-border investigations create conflicts involving jurisdiction, privacy, disclosure and evidence transfer.

Ethical hacking is legitimate only when authority, scope and purpose are established. A professional should:

• obtain informed written authorisation;
• minimise disruption and unnecessary data collection;
• protect client and third-party confidentiality;
• disclose serious findings promptly and accurately;
• preserve evidence without altering it unnecessarily;
• avoid exploiting a weakness beyond what is needed to demonstrate risk; and
• document limitations, uncertainty and residual risk.

The principle of “permission” is fundamental. A technically skilled action can still be unlawful if performed without authorisation. Professional codes, organisational policies, data-protection rules, contractual terms and computer-misuse laws may all apply.

6. From Ethical Hacking to Red Teaming

These practices are complementary but have different purposes.

A red team normally operates against agreed objectives and may test people, processes and technology. A blue team defends and detects. A purple-team activity brings both together to improve detection and response. Red-team success is not simply “obtaining access”; it may reveal that monitoring, escalation or recovery failed.

7. Incident Response and Forensic Investigation

Incident response is an organised capability for handling suspected or confirmed security incidents. A common lifecycle contains preparation; detection and analysis; containment; eradication and recovery; and post-incident activity. Real incidents are iterative: new evidence may cause investigators to revisit earlier conclusions.

Digital forensics is the disciplined examination of digital artefacts to answer questions such as:

• What systems, accounts or data were involved?
• When did relevant actions occur?
• What access or modification took place?
• Which hypotheses are supported or contradicted?
• What is known, unknown or uncertain?

A defensible forensic process usually includes identification, preservation, collection or acquisition, examination, analysis, documentation and reporting. Investigators should work from the question and evidence requirements rather than collect everything indiscriminately.

Evidence types

Digital evidence may be classified by source and function:

• Volatile evidence: data lost when power or a process state changes, such as memory contents, active connections and running processes.
• Non-volatile evidence: data retained on storage, such as files, databases, logs and configuration records.
• Network evidence: packet captures, flow records, firewall events, DNS records and proxy logs.
• Cloud and service evidence: identity logs, audit trails, API events, virtual-machine snapshots and provider records.
• Endpoint artefacts: browser history, scheduled tasks, event logs, shell history, registry data and application records.
• Human and documentary evidence: interviews, tickets, email correspondence, policies and access approvals.

Evidence may also be direct, circumstantial, corroborative or exculpatory. A login record is not automatically proof that a person performed an action; credentials may have been stolen, systems may have inaccurate clocks and logs may be incomplete.

Preservation and chain of custody

Preservation protects evidence from alteration, loss and contamination. Investigators should record who collected an item, when and where it was collected, the method used, storage location, transfers, hashes where appropriate and every relevant action. A cryptographic hash can support integrity verification:

Here, m is the digital message or file, H is a specified hash function and h is the resulting digest. The formula assumes the same algorithm and exact input bytes are used. Matching digests support a claim that the inputs are unchanged under the algorithm; they do not establish authenticity, ownership or complete provenance.

Forensic acquisition should be as complete and repeatable as practical. Analysts should use validated tools, preserve originals, work on copies, record tool versions and disclose limitations. Legal admissibility depends on jurisdiction, relevance, reliability, authenticity and procedural compliance.

8. Indicators and the Evidence-to-Decision Relationship

An indicator is an observable sign relevant to security analysis. An indicator of compromise (IOC) may be a malicious file hash, suspicious domain, unusual persistence mechanism or known attacker address. An indicator of attack (IOA) focuses on behaviour, such as abnormal privilege escalation or credential dumping. Indicators of exposure identify conditions that increase susceptibility, such as an internet-facing unpatched service.

Indicators require context. A single failed login may be benign; a sequence of failures followed by a successful login, privilege change and unusual data transfer is more significant. Detection engineering should combine identity, endpoint, network and application telemetry while considering false positives, false negatives, privacy and retention costs.

A simplified investigative reasoning cycle is:

1. Observe an event or report.
2. Form competing hypotheses.
3. Collect relevant evidence.
4. Test temporal, technical and contextual consistency.
5. Contain or remediate proportionately.
6. Record confidence, limitations and lessons.

This approach prevents premature attribution and encourages evidence-based decisions.

9. Applied Case: Illustrative Ransomware Investigation

Background

A fictional university experiences widespread inability to open shared files. Several employees report that files have new extensions and a ransom note appears. The university operates identity services, endpoint systems, cloud applications and a research network.

Problem

Management must determine whether the event is ransomware, contain it without destroying evidence, protect student information and restore teaching services. It must also establish the likely entry route and whether data was exfiltrated.

Analysis

The incident team first declares an incident, isolates affected network segments and preserves relevant logs. Investigators record system times and identify the earliest reliable indicators. Endpoint evidence shows a suspicious script launched from a compromised account. Identity logs show an unusual login from a new location, followed by multifactor-authentication fatigue events. Proxy logs reveal connections to an unfamiliar domain, while file-server logs show rapid modification of thousands of files.

The team avoids assuming that the compromised account owner caused the activity. Memory and disk images are acquired from selected systems according to priority. Hashes and custody records are maintained. Backups are checked for integrity before restoration. Cloud audit logs are requested from the provider because local records do not contain all API activity.

Approach and solution

Containment includes disabling the account, revoking sessions and tokens, blocking malicious infrastructure, isolating affected hosts and restricting administrative access. Eradication includes removing persistence, resetting credentials, patching the initial weakness and improving multifactor-authentication controls. Recovery proceeds in stages, beginning with critical services and verified backups.

Forensic analysis correlates identity, endpoint, network and file events into a timeline. The team assesses whether the evidence supports data theft, distinguishes confirmed facts from hypotheses and obtains legal advice regarding notification obligations. A post-incident review maps failures to preventive and detective controls.

Outcome and learning points

Services are restored from clean backups. The investigation concludes with high confidence that an account takeover preceded ransomware deployment, but only moderate confidence regarding attempted exfiltration because provider logs were incomplete. The university improves authentication policies, privileged access management, network segmentation, log retention, backup testing and user reporting channels.

The case demonstrates that response and forensics must proceed together but have different priorities. Response limits harm quickly; forensics preserves and interprets evidence. It also demonstrates that “who owned the account” is not equivalent to “who performed the action.”

10. Governance, Privacy and Contemporary Developments

Security monitoring can expose personal information, communications and behavioural patterns. Organisations should define a lawful purpose, collect proportionately, restrict access, establish retention periods and protect investigative records. Cross-border cloud evidence may require provider procedures, legal process or international cooperation.

Artificial intelligence is increasingly used for malware classification, anomaly detection, alert triage and summarisation. It can improve scale but may generate inaccurate explanations, amplify biased baselines, omit rare attacks or expose sensitive evidence to unauthorised services. Human review, provenance, access controls, testing and documented confidence are essential. Generative systems must not be treated as autonomous forensic authorities; conclusions should be reproducible from underlying evidence.

Important contemporary challenges include encrypted traffic, cloud ephemerality, container and serverless evidence, supply-chain compromise, deepfakes, ransomware-as-a-service, identity-centric attacks and the increasing volume of telemetry. Professional practice therefore requires continuous learning, validated tools, threat-informed architecture and cooperation among technical, legal, managerial and privacy specialists.

Chapter Summary

Cybersecurity is the management of risks to information, systems, people and services. Confidentiality, integrity, availability, authenticity and accountability provide foundational security objectives. Threat actors differ in motivation and capability, while attack surfaces include technical, human, physical and supply-chain entry points. Vulnerabilities are weaknesses; exploits are methods that take advantage of them; indicators are observations that support detection and investigation.

Vulnerability assessment, penetration testing, ethical hacking and red teaming have different objectives. Incident response prioritises containment and recovery, whereas digital forensics seeks reliable answers from preserved evidence. Evidence can be volatile, persistent, network, cloud, endpoint, documentary, direct or circumstantial. Hashes support integrity verification but do not by themselves prove authorship or authenticity. Ethical and legally authorised practice, careful documentation, privacy protection and explicit uncertainty are essential to defensible cybersecurity work.

Key Terms

Confidentiality: Protection of information from unauthorised access or disclosure.

Integrity: Assurance that information remains accurate, complete and protected from unauthorised modification.

Availability: Accessibility of systems and information to authorised users when required.

Authenticity: Confidence that an entity, message or artefact is genuine.

Accountability: Ability to associate actions with responsible identities and processes.

Asset: Something valuable that requires protection.

Threat: A potential cause of harm.

Vulnerability: A weakness that may be exploited.

Exploit: A technique or mechanism that takes advantage of a vulnerability.

Attack surface: The reachable points through which attack attempts may occur.

Risk: The possibility of adverse consequences arising from threats and vulnerabilities.

IOC: Indicator of compromise; an observable sign associated with compromise.

IOA: Indicator of attack; an observable behaviour associated with an attack technique.

Ethical hacking: Authorised security testing conducted for defensive purposes.

Red teaming: Adversary-oriented testing of an organisation’s ability to prevent and detect realistic attacks.

Incident response: Coordinated handling of a security incident.

Digital forensics: Systematic preservation, examination and interpretation of digital evidence.

Chain of custody: Documented history of evidence possession, handling and transfer.

Volatile evidence: Evidence that may disappear when a system or process changes.

Defence in depth: Use of multiple layers of security controls.

Review Questions

Short Answer Questions

1. Define confidentiality, integrity and availability, and give one control supporting each.
2. What is the difference between a vulnerability and an exploit?
3. Why does authorisation matter in ethical hacking?
4. Distinguish an indicator of compromise from an indicator of attack.
5. What information should a chain-of-custody record contain?

Long Answer Questions

1. Explain how threat actors, attack surfaces, vulnerabilities and risks are related.
2. Compare vulnerability assessment, penetration testing, red teaming, incident response and digital forensics.
3. Discuss why a cryptographic hash supports evidence integrity but does not prove authorship.
4. Explain the major stages of a defensible digital-forensic investigation.
5. Evaluate the ethical, privacy and legal responsibilities of a professional security tester.

Analytical / Application Questions

1. An organisation detects an unusual administrator login followed by mass file modification. Design an initial response and forensic-preservation plan, explaining the order of priorities.
2. A penetration tester discovers a serious vulnerability in a supplier-managed system outside the written scope. Analyse the professional and governance steps that should follow.
3. A security team has thousands of alerts but limited analysts. Propose a method for combining indicators, asset criticality, identity context and evidence quality to prioritise investigation.

Multiple Choice Questions with Answers

Question 1

Which security objective concerns protection against unauthorised modification?

A. Confidentiality

B. Integrity

C. Availability

D. Authenticity

Correct Answer: B. Integrity

Question 2

Which statement best distinguishes a vulnerability from an exploit?

A. A vulnerability is a weakness; an exploit uses that weakness

B. A vulnerability is always malicious; an exploit is always accidental

C. A vulnerability is evidence; an exploit is a legal authorisation

D. A vulnerability is a backup; an exploit is a recovery plan

Correct Answer: A. A vulnerability is a weakness; an exploit uses that weakness

Question 3

What is the primary purpose of red teaming?

A. To replace all vulnerability scanning

B. To test realistic adversary objectives and organisational detection

C. To preserve disk images after an incident

D. To classify personal data

Correct Answer: B. To test realistic adversary objectives and organisational detection

Question 4

Which is an example of volatile evidence?

A. A powered-off archived hard disk

B. A printed incident report

C. Running-process and memory information

D. A digitally signed policy document

Correct Answer: C. Running-process and memory information

Question 5

What does a matching cryptographic hash most directly support?

A. Proof of the user’s intent

B. Proof that two inputs are unchanged and identical under the algorithm

C. Proof that the file was legally obtained

D. Proof that a named person created the file

Correct Answer: B. Proof that two inputs are unchanged and identical under the algorithm

Question 6

Which action is most appropriate before conducting an intrusive ethical-hacking test?

A. Obtain written authorisation and define rules of engagement

B. Publish the target list publicly

C. Disable all monitoring controls

D. Test unrelated third-party systems

Correct Answer: A. Obtain written authorisation and define rules of engagement

Question 7

An indicator of attack is primarily concerned with:

A. A behavioural sign associated with an attack technique

B. The replacement cost of hardware

C. The organisation’s annual revenue

D. The physical location of a server room

Correct Answer: A. A behavioural sign associated with an attack technique

Question 8

Which activity primarily prioritises containment and recovery during an active event?

A. Digital archiving

B. Incident response

C. Code compilation

D. Asset disposal

Correct Answer: B. Incident response

Question 9

Why should investigators avoid assuming that the owner of an account performed an action?

A. Accounts cannot produce logs

B. Credentials or sessions may have been compromised

C. Authentication makes attribution impossible in every case

D. File systems never record timestamps

Correct Answer: B. Credentials or sessions may have been compromised

Question 10

In the conceptual model Risk ≈ Likelihood × Impact, impact refers to:

A. The estimated chance of an event

B. The magnitude of harm if the event occurs

C. The number of security tools deployed

D. The time needed to hash a file

Correct Answer: B. The magnitude of harm if the event occurs