Introduction: CIS8630 Business Computer Forensics and ... · Computer forensics is the process of...
Transcript of Introduction: CIS8630 Business Computer Forensics and ... · Computer forensics is the process of...
1
Introduction: CIS8630Business Computer
Forensics and IncidentResponseRichard Baskerville
Georgia StateUniversity
2
PPolicy Enforcement
P Information Security
PLegal Protection andPreparedness
PPrivacy Protection
PPerformance Assurance
Motivation: Why this topic matters
3
Interaction of Left & Right Paradigms
Threat
Information SystemResource
Detect
Contain, Recover, HardenPrevent
Deter
Respond
Left of Incident Right of Incident
Adapted from Denning, D. E. (1999). Information Warfare andSecurity. Reading Mass: Addison-Wesley.
Refine
Indications &Warnings
Incident
Legislate &Policy Setting
Investigate, Notify,Sue, Prosecute,
Retaliate
4
PPrevention
P Indications and Warnings
PDeterrence
PCrime or Policy Violation
Left of incident
5
PDetection
PResponse< Contain/recover/harden< Legislate/Policy< Investigate, Notify, Sue, Prosecute, Retaliate
Right of incident
6
Left vs. Right Paradigms
Assumptions
Adapted from Baskerville, R. (2005). Information Warfare: A Comparative Framework forBusiness Information Security. Journal of Information Systems Security, 1(1), 23-50.
7
Left vs. Right Paradigms
Logical Structure
Adapted from Baskerville, R. (2005). Information Warfare: A Comparative Framework forBusiness Information Security. Journal of Information Systems Security, 1(1), 23-50.
8
Left vs. Right Paradigms
Organizing Principles
Adapted from Baskerville, R. (2005). Information Warfare: A Comparative Framework forBusiness Information Security. Journal of Information Systems Security, 1(1), 23-50.
Left of Incident Right of Incident
9
PAny information-related activity with negativesecurity implications. < Usually means that the activity violates an explicit
or implicit information security policy.
Information Security IncidentAdapted from Mitropoulos, S., Patsos, D., & Douligeris, C. (2006). On Incident Handling and Response: A
state-of-the-art approach. Computers & Security, 25(5), 351-370
10
PA security incident is a change ofstate in a bounded informationsystem from the desired state toan undesired state, where thestate change is caused by theapplication of a stimulus externalto the system.
Information Security IncidentAdapted from Stephenson, P. (2004). Managing digital incidents - a background. Computer Fraud & Security,
2004(12), 17-19.
11
PPenetration
PFraud
PDenial-of-service
PVirus/worm infection
Basic types of InformationSecurity Incident:
Adapted from Stephenson, P. (2004). Managing digital incidents - a background. Computer Fraud & Security,2004(12), 17-19.
12
P Incident response:procedures that mitigatethe immediate impact ofthe threat, eliminate anypossible consequentialloss and prevent anypossible futurerecurrence
Business Computer IncidentResponse
from Abimbola, A. (2007). Information security incident response. Network Security, 2007(12), 10-13.
13
P Interdiction: Stopping orinterrupting the incident
PContainment: Isolating damageand preventing it from spreading
PRecovery: Returning the businessto the pre-incident state
PAnalysis: Post-incident root causeanalysis (post-mortem)
Incident Response Methodologye.g. Stephenson, P. (2004). Managing digital incidents - a background. Computer Fraud & Security,
2004(12), 17-19.
14
P Analysis of security vulnerabilities and new threat research,and dissemination of countermeasures information
P Coordination of response to all information securityincidents, such as malicious code (worms, viruses, trojanhorses, etc.),
P Investigation of security incidents involving companycomputing resources (including abuse, harassment,blackmail, sabotage, and theft)
P Resolution (both hands-on and on a coordination level) ofgeneral threats to confidentiality, availability and integrity ofthe company’s data and systems
P Education of the users and the engineering and supportorganization about security issues and trends
Computer Security Incident Response Team(CSIRT)
e.g. Salomon, J. M., & Elsa, P. (2004). Computer security incident response grows up. Computer Fraud &Security, 2004(11), 5-7.
15
The application of forensicscience techniques tocomputer-based material, theprocess of identifying,preserving, analyzing, andpresenting digital evidence in amanner that is acceptable tolegal proceedings.
Business Computer ForensicsSolomon, M. G., Barrett, D., & Broom, N. (2005). Computer Forensics Jump Start. San Francisco: Sybex.p. 2
16
Computer forensics is the process ofmethodically examining computer media (harddisks, diskettes, tapes, etc.) for evidence. Computer forensics is also referred to ascomputer forensic analysis, electronicdiscovery, electronic evidence discovery,digital discovery, data recovery, datadiscovery, computer analysis, and computerexamination.
Business Computer ForensicsVacca, J. R. (2002). Computer Forensics: Computer Crime Scene Investigation. Hingham, Massachusetts:
Charles River Media. P. 4
17
Digital forensics is the use of scientificallyderived and proven methods toward thepreservation, collection, validation,identification, analysis, interpretation,documentation, and presentation of digitalevidence derived from digital sources forthe purpose of facilitation or furthering thereconstruction of events found to becriminal, or helping to anticipateunauthorized actions shown to be disruptiveto planned operations.
Business Computer ForensicsDigital Forensics Research Workshop. "A Road Map for Digital Forensics Research" 2001. www.dfrws.org
18
Computer Forensics Stakeholders
Crime & lawEnforcement
Forensic productmarketplace
Certifications andeducation
Business
Investigations
Civil lawsuitE-discovery
IncidentResponse
19
PFrequent visiting experts< Business forensics experts< Legal technical experts< Law enforcement
Forensics Community of Practice
20
Introduction: CIS8630Business Computer
Forensics and IncidentResponseRichard Baskerville
Georgia StateUniversity
21