Intel has responded to the need for security and performance by producing different CPU designs

Cost Assessment

Forensic readiness consists of costs involving administrative, technical, and physical information security controls implemented throughout the organization. Through the service catalog, each of these controls will be aligned to a service where all cost elements can be identified and allocated appropriately. While not all controls and services will contribute to digital forensic readiness, the following will have direct influences to the overall cost of the digital forensic readiness program:

Governance document maintenance is the ongoing review and updating to the information security and evidence management frameworks [eg, policies, standards, guidance, procedures];

Education and awareness training provides continued improvements to:

information security awareness of staff indirectly involved with the information security discipline;

information security training of staff directly involved with the information security discipline;

digital forensic training of staff directly involved with the digital forensic discipline.

Incident management involves the activities of identifying, analyzing, and mitigating risks to reduce the likelihood of reoccurrence;

Data security includes the enhanced capability to systematically gather potential evidence and securely preserve it;

Legal counsel provides advice and assurance that methodologies, operating procedures, tools, and equipment used during an investigation will not impede legal proceedings.

The inclusion of a service as a cost contributors to the digital forensic readiness program is subject to the interpretation and appetite of each organization. Knowing which services, where controls are aligned, contribute to the digital forensic readiness program is the starting point for performing the cost assessment. From the service catalog, the breakdown of fixed and variable costs can be used as part of the cost-benefit analysis for demonstrating to manage the value of implementing the program.

2.4 Digital forensic readiness assessment

Digital forensics readiness is the ability of organizations to respond quickly and collect digital evidence related to a security incident with minimal cost or interruption to the ongoing business. This involves being able to define digital evidence required so that security aspects in an organization such as programs or teams and infrastructure can be adapted and modified to provide this evidence in a timely manner [Trenwith and Venter, 2013].

There are several global standards to aid organizations in the processing of digital evidence. The International Standards Organization proposes a standard for the processing of digital evidence in a consistent manner [Standardization and Technical Committee ISO/IEC JTC1, 2012]. NIST also describes a process for the integration of digital forensics during the management of IT incidents [Kent et al., 2006]. Both standards provide a good starting point for organizations to understand the processes involved with collecting digital evidence. For example, the ISO standard goes through defined phases in digital evidence collection: identification, collection, and preservation. The NIST standard includes recommendations that involve the establishment of a forensic capability within the organization to better respond to security incidents requiring digital evidence.

In 2004, Rowlingson proposed a 10-step process that could be used by organizations as a means to improving their forensic readiness [Rowlingson, 2004]. The intent of this forensic readiness process is to increase an organization’s use of digital evidence but at the same time, minimize the cost of utilizing the data during a digital forensics investigation. This process generally includes improvements to system monitoring, technical and procedural and policy improvements to securing possible digital evidence, staff training and improvements of the interfaces with law enforcement.

Implementing digital forensics readiness should be incorporated as part of overall information security within an organization, and provides many benefits [Pangalos et al., 2010] [Rahman and Choo, 2015a]. IaaS providers should have the capability to conduct forensic investigations with minimal impact to the running of the service and to be able to respond quickly to requests for digital forensic evidence from law enforcement agencies or internal security teams.

Implementing forensic readiness may come at a cost, but for an existing organization which has already implemented a basic information security mechanism, the costs of extending existing information security mechanism to include forensic readiness activities are less expensive [Rowlingson, 2004].

The methodology used for judging forensic readiness is as follows:

Define the business scenarios that require digital evidence.

Identify available sources and different types of potential evidence.

Determine the evidence collection requirements.

Establish a capability for securely gathering legally admissible evidence to meet the requirement.

Establish a policy for secure storage and handling of potential evidence.

Ensure that monitoring is targeted to detect and deter major incidents.

Specify circumstances when escalation to a full formal investigation should be launched

Train staff in incident awareness.

Document an evidence-based case describing the incident and its impact.

Ensure legal review to facilitate action in response to the incident [Rowlingson, 2004].

Utilizing the above process, Company A was assessed and observations were made against each of these steps to determine the state of the organization’s forensics readiness.

3 Cloud incident handling model: a snapshot

In our design of the proposed model [see Figure 2], we draw upon principles and practices from incident handling and digital forensics. The proposed model consists of six phases, namely, Preparation [integrated with forensic readiness principles], Identification, Assessment [integrated with forensic collection and analysis practices], Action and Monitoring, Recovery, and Evaluation [integrated with forensic presentation practices]. This model is an extension of our recently published conceptual Cloud Incident Handling Model in Rahman and Choo [2015]. The earlier work discussed the model in four major phases, namely, preparation, detection and analysis, incident response, and postincident, as well as the involved costs at each phase. In this study, the Detection and Analysis and the Incident Response phases are expanded to include Identification and Assessment, and Action and Monitoring, and Recovery, respectively.

Preparation phase integrates forensic readiness requirements. The phase has a proactive element such as understanding and preparing the necessary tools or resources required to protect and secure a cloud’s systems or networks. Activities associated with forensic readiness include the identification of potential sources of evidential data [e.g., log files, network traffic records, CSU devices, off-site data centers, continually tracking authentication] in a cloud environment [e.g., CSPs, internet service providers, and third parties] and deciding where identified potential evidence sources should be stored.

Identification phase begins immediately after an incident or vulnerability is detected and reported, either by human [cloud users or CSP’s personnel] or automated tool. Unlike Preparation, this phase consists of reactive incident handling strategies.

In the Assessment phase, information from the received reports will be assessed to determine if the incident is a false alarm, and the potential impact[s] to the cloud’s core services and assets. If it is determined to be a false alarm, the process will be terminated. The integrated conceptual cloud forensic framework from Martini and Choo [2013] is implemented to enable forensic investigations. Forensic examiners will undertake the evidence collection process from the potential sources identified in the Preparation phase. Once the evidence has been preserved and collected, the forensic analysis process will then commence.

Action and monitoring phase involves the execution and monitoring of the appropriate response strategy in an effective and timely manner as determined in the incident escalation strategy. It is important to note that the response strategy [i.e., action] may vary between incidents and incidents assigned to different priority levels.

Recovery phase involves the restoration of system operation back to normal at both logical and physical levels. Evaluation phase involves a formal evaluation [e.g., postmortem meeting] where issues such as the nature of the incidents, a review of what had occurred, the intervention techniques, and the [in] effectiveness and lessons learnt are examined.

Embedded Device Forensics

One of the greatest challenges facing the field of digital forensics is the proliferation of consumer-grade electronic hardware and embedded devices. While forensic investigators have had decades to understand and develop tools and techniques to analyze magnetic disks, newer technologies such as Solid State Drives [SSDs] lack both forensic understanding and forensic tools capable of analysis.

Vassilakopoulos Xenofon discussed this challenge in his paper GPS Forensics, A systemic approach for GPS evidence acquisition through forensics readiness: “The field of digital forensics has long been cantered on traditional media like hard drive. Being the most common digital storage device in distribution it is easy to see how they have become a primary point of evidence. However, as technology brings digital storage to be more and more of larger storage capacity, forensic examiners have needed to prepare for a change in what types of devices hold a digital fingerprint. Cell phones, GPS receiver and PDA [Personal Digital Assistant] devices are so common that they have become standard in today’s digital examinations. These small devices carry a large burden for the forensic examiner, with different handling rules from scene to lab and with the type of data being as diverse as the suspects they come from. Handheld devices are rooted in their own operating systems, file systems, file formats, and methods of communication. Dealing with this creates unique problems for examiners.” [3]

Precollection Questions

Deciding on what the organization’s requirements are for proactively gathering digital evidence requires some preliminary activities to be completed before work can begin on creating an overall statement describing exactly what these requirements are. As the moderating factor to producing a requirements statement comes the need to complete a cost–benefit analysis [CBA].

Similar to how a CBA is used to determine if implementing a digital forensic readiness program is valuable to an organization, as discussed in chapter “Understanding Forensic Readiness,” this time around it is used to help organizations determine factors such as how much it will cost to gather the digital evidence and what benefit there is in collecting it. To determine if creating a requirements statement is beneficial, organizations have to answer several questions that focus on whether it can be done in a cost-effective manner.

Question #1: Can a forensic investigation proceed at a cost in comparison to the cost of an incident?

To get an accurate comparison, organizations have to factor in all monetary aspects associated with conducting an investigation in reaction to an incident against the resulting impact of an incident. As a starting point, organizations can pull cost elements from their service catalog, discussed further in Appendix D: Service Catalog, to understand how administrative, technical, and physical security controls contribute to conducting a forensic investigation. Examples of cost elements that organizations must consider to be included as part of this comparison includes ongoing maintenance of governance documentation [ie, standard operating procedures [SOP]]; resource allocation to facilitate both the incident management and continuous improvement activities; and the operational cost for all tools and technologies used to manage the business risk. With this initial analysis complete, a secondary comparison must be complete including all monetary aspects, tangible and intangible, associated with conducting an investigation having proactively gathered digital evidence against the resulting impact of an incident. Using results from the two comparative analyses, organizations can determine quantitative benefits of creating a requirements statement.

Question #2: Can the digital evidence be gathered without interfering with business functions and operations?

When conducted in reaction to an event, forensic investigations can require that organizations temporarily assigned several support resources to assist in the gathering of digital evidence. In some instances, the organization might realize that their ability to effectively and efficiently gather digital evidence in reaction to an incident is challenged by some type of roadblock [ie, restoration time delay]. Where potential digital evidence can be proactively gathered, organizations can benefit from having digital evidence readily available when needed and not having to re-allocate resources away from their day-to-day business operations to assist. This improvement in operational efficiencies can reduce the need for resources to be temporarily removed from their normal duties and avoid any lost productivity or degradation in service availability.

Question #3: Can a forensic investigation minimize the impact or interruption to business functions and operations?

The potential for an incident to result in the loss or degradation of day-to-day business operations is a realistic scenario that most organizations face. In reaction to these events, the organization’s ability to manage the incident has a direct dependency on their capability to quickly gather and process digital evidence to understand the content and context of the incident. Having digital evidence gathered and made readily available, not only can the organization improve on the amount of time needed to investigate but they can also enable the ability to conduct proactive investigations. In addition to supporting forensic investigations, the capability to perform proactive investigations in support of security control assessments or user behavior analytics can reduce the likelihood of an event resulting in impact or interruption to the business.

Question #4: Can the digital evidence make a positive impact on the likely success of any formal legal actions?

Producing digital evidence in support of legal matters requires that organizations ensure their electronically stored information [ESI]1 is admissible in a court of law. As discussed in chapter “Evidence Management,” the US Federal Rules of Evidence 803[6] describes that ESI is admissible as digital evidence in a court of law if it demonstrates business “records of regularly conducted activity”; such as an act, event, condition, opinion, or diagnosis. Determining the relevance and usefulness of ESI as digital evidence before creating a collection requirements statement ensures that organizations will not give way to overcollecting resulting in unnecessary downstream processing and review expenses.

Question #5: Can the digital evidence be gathered in a manner that does not breach the compliance with legal or regulatory requirements?

Laws and regulations can be imposed against organizations depending on several factors such as the industry they operate within [ie, financial] or the countries they conduct business [ie, the Unites States, India, Great Britain]. Organizations must have a good understanding of how these governing laws and regulations influence the way they conduct their business operations. To provide reasonable assurance there is adherence to these requirements, organizations may need to produce digital evidence of controls that demonstrate they are practicing a reasonable level of due care. Consideration must be given on how background and foreground digital evidence, as discussed in chapter “Identify Potential Data Sources,” will be proactively gathered and preserved in accordance with the compliance requirements.

Assessing the quantitative and qualitative implications of creating a collection requirements statement in advance helps organizations to determine if proactively gathering digital evidence will reduce investigative costs; such as selecting storage options, purchasing technologies, and developing SOPs. Appendix E: Cost-Benefit Analysis, further discusses how to perform a CBA in support of producing the digital evidence collection requirements statement.

eDiscovery

ediscovery is a term that is sometimes used interchangeably with the terms computer forensics or digital forensics, however, to use them interchangeably is inaccurate. eDiscovery, short for electronic discovery, is the term used to refer to any type of electronic evidence produced during the course of civil litigation. In essence, the difference between eDiscovery and computer forensics is a question of order, and in its most fundamental sense, the distinguishing characteristic is volume. Typically, large eDiscovery projects involve the reconstruction of massive quantities of documents, e-mails, and other information from systems, servers, and backup media to large databases and searchable formats. These items are then reviewed by legal document review experts that will decide whether or not the information is relevant to the case. Software developers continue to produce programs that are capable of organizing and managing these massive discovery projects to make review more efficient and simple. These programs can cost thousands of dollars to purchase.

The term is used particularly in this manner because it is more a legal term of art than a scientific term. Further, there is a plethora of case law surrounding large-scale and typically expensive litigation costs to produce eDiscovery projects. Forensic examiners assist in the process of eDiscovery by determining locations where evidence relative to the civil litigation may exist, copying it, and producing it to litigators in some type of understandable form. Oftentimes there is contentious debate about the scope of what a party in litigation is or is not entitled to from the other party. Rule 26 and 34 of the FRCP now deal with ESI. Private computer forensic practitioners, boutique firms, and the big five forensic consulting agencies all deal extensively with eDiscovery in civil litigation.

In US law, discovery is the pretrial phase in a lawsuit in which each party, through the rules of civil procedure, can obtain evidence from the opposing party by means of discovery devices including requests for answers to interrogatories, requests for production of documents, requests for admissions, and depositions. Discovery can be obtained from nonparties using subpoenas. eDiscovery is concerned with the identification, Preservation, collection, processing, review and production of electronic documents that exist across a system or corporate network. The term eDiscovery was initially a US term, and in the United Kingdom this process is known as Disclosure.

In the discovery process, data are identified as potentially relevant by attorneys and the data is placed on legal hold. A legal hold refers to a process which an organization uses to preserve all forms of relevant information when it reasonably anticipates some type of litigation against it. It is a restriction on a record that exists as a result of current or anticipated litigation, audit, government investigation or other such matter that suspends the normal disposition or processing of records. Evidence is then extracted and analyzed using digital forensic procedures, and is reviewed using a document review platform. A document review platform is useful for its ability to aggregate and search large quantities of similar type/formatted ESI. ESI is considered different from paper-based information because of its intangible form, volume, transience, and persistence. ESI is usually accompanied by Metadata that is not found in paper documents and that can play an important part as evidence [e.g., the date and time a document was written could be useful in a copyright case]. The preservation of Metadata from electronic documents creates special challenges to prevent spoliation.

The Electronic Discovery Reference Model [EDRM] diagram shown here represents a conceptual view of the eDiscovery process.

The EDRM1 was developed in 2005 to help create best practices and guidelines for those working in the field of eDiscovery [lawyers, eDiscovery vendors, organizations preparing for litigation, and so on]; and that it has become a standard of going through the eDiscovery process and aiding adherence to the US FRCP. The model as depicted in the figure above has nine phases as follows:

Information Management

Identification

Preservation

Collection

Processing

Review

Analysis

Production

Presentation.

7.7 Forensic Readiness

Forensic readiness as defined by Mohay [85] as “ the extent to which computer systems or computer networks record activities and data in such a manner that the records are sufficient in their extent for subsequent forensic purposes, and the records are acceptable in terms of their perceived authenticity as evidence m subsequent forensic investigations”. Forensic readiness aims to allow a certain organization to have the required administrative, technical, and physical control that allows them to produce an efficient investigation. It is used to measure the ability of a certain organization to generate a digital investigation in a forensically sound way. The integration of forensics readiness in IoT systems remains a challenging topic and need more research to make IoT networks forensically ready [86].

3.3.1 Preparation + forensic readiness

Activities for forensic readiness involve the identification of potential sources of evidential data [e.g. log files, network traffic records, CSU devices, off-site datacentres, continually tracking authentication] in a cloud environment [e.g. CSPs, internet service providers and third parties]. Forensic readiness measure such as having dedicated digital forensic workstations and software will improve chances of evidence collection and minimise the cost of a forensic investigation. Potential work products in this phase include incident handling strategy manual/handbook, security and risk management policy, and awareness and training programmes report.

Investment cost [IC] refers to the cost of implementing Information Security [IS] infrastructure in an organisation. It comprises three main categories, namely: people, process, and technologies. People cost includes the cost of setting up a dedicated department and employing IS personnel, process cost includes the cost of establishing IS objectives, and technology cost includes procurement cost for IS protection technology. The Return on Investment [ROI] is typically used to evaluate investment strategies by comparing investment alternatives. In a security context, Return On Security Investment [ROSI] has been studied by various researchers such as Cavusoglu et al. [2004], Kheir and Cuppens-Boulahia [2010], Chai et al. [2011], Tsalis et al. [2013], and Bojanc et al. [2012] to understand the value of IS investment. An example ROSI formula is defined in Eq. [1] [Sonnenreich et al., 2006].

[1]ROSI=[[Risk Exposure ∗%Risk mitigated]−IC]]/IC

Higher values of ROSI indicate a more efficient security investment [Böhme, 2010].

5.3 Digital forensic investigation framework for IoT [DFIF-IoT]

Proposed by [Kebande and Ray, 2016], this process model is based on a generic approach that analyses digital forensics data in the IoT setup through process concurrency. The model is presented to capture data at all the three levels of the IoT forensics.

Through the process concurrency, the model aims to establish IoT forensics readiness and increase the rate at which the digital evidence extracted is admissible in a court of law. From the readiness point of view, this model will require a momentous consideration to proactive scenario–driven activities to ensure that the potential evidence is captured with the IoT setup and that implementation for extraction and preservation of the evidence is done in a procedure that is well-defined and documented. It is through this that the evidence will be forensically sound.

The drawback with this model, however, is that it is purely based on theoretical approach in the collection of the forensic data. There is no physical experimental in its implementation and evaluation thereby casting doubts on its practicality.

As an extension of DFIF-IoT [Kebandeet al., 2018], proposed an Integrated Digital Forensic Investigation Framework [IDFIF-IoT] which claimed that DFIF-IoT was generic with processes that relied on ISO/IEC 27043 international standards while IDFIF-IoT includes organisational policy making it more policy oriented.

This framework is still more theoretical than practical and as also pointed out by the authors themselves, the framework needs more development so as to identify more critical aspects of forensics.