NPU Digital Forensics and Risk Management Program Essay The readings this week expand on investigation and of digital forensic analysis and investigations.

NPU Digital Forensics and Risk Management Program Essay The readings this week expand on investigation and of digital forensic analysis and investigations. Organizations, especially those in the public, health and educational areas are bound by legal and statutory requirements to protect data and private information, therefore digital forensics analysis will be very beneficial when security breaches do occur. Using this weeks readings and your own research, discuss digital forensics and how it could be used in a risk management program. O
AR
FE
place
2010 ACS
ASSOCIA
TI
ON
RESE
TI
nd
NI
TI
NS
Y
AL
PER COM
PA
PE
H
N
TI
UN
M
C
N
U
E ACQUISI
I V E RS I T
2
O
D
E
METRICS-BASED
Risk Assessment
and Management
of DIGITAL FORENSICS
Mehmet Sahinoglu, MSgt Stephen Stockton, USAF (Ret.),
Capt Robert M. Barclay, USAF (Ret.), and Scott Morton
Driven by the ubiquity of computers in modern life and the subsequent rise of
cybercriminality and cyberterrorism in the government and defense industry,
digital forensics is an increasingly salient component of the defense acquisition process. Though primarily located in the law enforcement community,
digital forensics is increasingly practiced within the corporate world for legal
and regulatory requirements. Digital forensics risk involves the assessment,
acquisition, and examination of digital evidence in a manner that meets legal
standards of proof and admissibility. The authors adopt a model of digital
forensics risk assessment that quantifies an investigator’s experience with

lead image by Diane Fleischer
eight crucial aspects of the digital forensics process. This research adds the
concept of quantifying through a designed risk meter algorithm to calculate
digital forensics risk indices. Numerical and/or cognitive data were painstakingly collected to supply input parameters to calculate the quantitative
risk index for the digital forensics process. Much needed risk management
procedures and metrics are also appended.
Keywords: Cyberterrorism, cybercriminality, risk meter
A Publication of the Defense Acquisition University
http://www.dau.mil
Digital forensics is a topic that has been popularized by television programs such as CSI. Crime-solving glamour and drama aside, the reality is
that the digital forensics process is a highly technical field that depends
on the proper implementation of specific, well-accepted protocols and
procedures. Inadequate forensic tools and technical examination, as well
as lack of adherence to appropriate protocols and procedures, can result
in evidence that does not meet legal standards of proof and admissibility.
Digital forensics risk arises, for example, when personnel lack the proper
tools to conduct investigations, fail to process evidentiary data properly, or
do not follow accepted protocols and procedures.
Assessing and quantifying digital forensics risk is the goal of this article. To
do so, the authors utilize a digital forensics risk meter, based on a series of
questions designed to assess respondents’ perceptions of digital forensics
risk. Based on the responses, a digital forensics risk index will be calculated.
Where this approach differs is that other approaches typically provide general guidance in the form of best practices, classification schemes or, at best,
a checklist for digital forensics procedures, and do not provide quantitative
tools (based on game theory) for risk management and mitigation. Examples
of other such approaches follow:
154
Defense ARJ, April 2016, Vol. 23 No. 2 : 152–177
April 2016
•
U.S. Department of Justice, Forensic Examination of Digital
Evidence: A Guide for Law Enforcement (general guidelines and
worksheets) (U.S. Department of Justice, 2004)
•
Error, Uncertainty, and Loss in Digital Evidence (certainty
levels) (Casey, 2002)
•
Cyber Criminal Activity Analysis Models using Markov Chain
for Digital Forensics (suspicion levels) (Kim & In, 2008)
•
Two-Dimensional Evidence Reliability Amplification Process
Model for Digital Forensics (evidence reliability) (Khatir,
Hejazi, & Sneiders, 2008)
•
Building a Digital Forensic Laboratory: Establishing and
Managing a Successful Facility (checklist) (Jones & Valli, 2011)
One approach that does employ quantification, Metrics for Network Forensics
Conviction Evidence, is confined to network forensics—mostly measuring
severity impact—and does not provide mitigation advice (Amran, Phan,
& Parish, 2009). In that research article, the authors show “how security
metrics can be used to sustain a sense of credibility to network evidence
gathered as an elaboration and extension to an embedded feature of Network
Forensics Readiness (NFR).” They then propose “a procedure of evidence
acquisition in network forensics … then analyze a sample of a packet data in
order to extract useful information as evidence through a formalized intuitive model, based on capturing adversarial behavior and layer analysis, …
apply the Common Vulnerability Scoring System—or CVSS metrics to show
the severity of network attacks committed…”(p. 1).
The digital forensics risk meter presented in this article will provide objective, automated, dollar-based risk mitigation advice for interested parties
such as investigators, administrators, and officers of the court to minimize
digital forensics risk. Figure 1 represents a decision tree diagram to assess
risk; Figure 2 (with the Advice column on the right extracted from Figure
B-1, Appendix B) represents sample mitigation advice generated from the
respondents’ inputs. This article will not only present a quantitative model,
but will generate a prototype numerical index that facilitates appropriate
protocols and procedures to ensure that legal standards of proof and admissibility are met.
Defense ARJ, April 2016, Vol. 23 No. 2 : 152–177
155
A Publication of the Defense Acquisition University
http://www.dau.mil
FIGURE 1. DIGITAL FORENSICS RISK DIAGRAM
Protocols &
Procedures
Mission Statement
Personnel
Administrative
Service Request/Intake
Case Management
Evidence
Assessment
Evidence Handling/
Retention
Case Processing
Technical Procedures
Development
Evidence
Acquisition
Case Assessment
Onsite
Location Assessment
Processing
Search Authority
Evaluation
Evidence
Examination
Precautions
Protection
Preservation
Digital
Forensics
Risk
Preparation
Physical Extraction
Logical Extraction
Timeframe Analysis
Documentation
& Reporting
Digital
Forensics Tools
Data Hiding Analysis
Application/File Analysis
Ownership/Possession
Examiner Notes
Examiner Report
Findings Details/
Summation
Hardware
Software
Training
Legal
Aspects
Funding
Jurisdiction
Search & Seizure
Admissibility
Victim
Relations
156
Defense ARJ, April 2016, Vol. 23 No. 2 : 152–177
Victim Rights & Support
Court Preparation
Media
0.317111
0.220042
Vulnerab.
0.440741
0.559259
0.346476
0.237754
0.415771
Threat
0.375000
0.625000
0.375000
0.625000
0.087352
0.278295
0.550000
0.097541
0.721705
0.450000
0.450000
0.550000
0.450000
0.034308
0.550000
0.625000
0.032697
0.625000
0.675000
0.375000
0.061754
0.375000
0.675000
CM &
LCM
0.325000
Res.
Risk
0.325000
CM &
LCM
0.087352
0.049355
0.034308
0.032697
0.061754
Res.
Risk
0.271705
Change
$49.77
Opt
Cost
Unit
Cost
Final
Cost
Advice
Increase the
CM capacity for
threat “Examiner
Notes” for the
vulnerability of
“Documentation
& Reporting”
from 45.00%
to 72.17% for an
improvement of
27.17%
FIGURE 2. MEDIAN DIGITAL FORENSICS RISK METER RESULTS MITIGATED TO 35.83%
April 2016
Defense ARJ, April 2016, Vol. 23 No. 2 : 152–177
157
158
0.408269
0.462847
Defense ARJ, April 2016, Vol. 23 No. 2 : 152–177
0.725000
0.043414
0.275000
0.275000
0.43414
0.725000
0.425000
0.425000
0.049305
0.575000
0.575000
0.000805
0.051966
0.275000
CM &
LCM
0.999195
Res.
Risk
0.725000
CM &
LCM
0.341085
0.250646
Threat
Vulnerab.
0.049305
0.000152
Res.
Risk
Total
Cost
$100.00
54.59%
$50.23
Opt
Cost
Total
Change
0.274195
Change
$1.83
Break
Even
Cost
Unit
Cost
Total
Final
Cost
Final
Cost
Increase the CM
capacity for threat
“Victim Rights &
Support” for the
vulnerability of
“Victim Relations”
from 72.50% to
99.92% for an
improvement of
27.42%
Advice
FIGURE 2. MEDIAN DIGITAL FORENSICS RISK METER RESULTS MITIGATED TO 35.83%, CONTINUED
A Publication of the Defense Acquisition University
http://www.dau.mil
$1,000.00
Capital
Cost
$458.34
ECL
Optimize
Show where you are in
Security Meter
Change
Cost
0.458337
45.833670
0.458337
Final Risk
Percentage
Total Risk
ECL Delta
ECL
Final Risk
Percentage
Total Risk
$100.00
$358.34
0.358337
35.833698
0.358337
Update Survey Questions
Print All Threat/CM Selections
Print Advice Threat/CM Selections
Print Single Threat/CM Selection
View Threat Advice
Print Results Table
Print Summary
Calculate Final Cost
Change Unit Cost
Note. CM = Countermeasure; ECL = Expected Cost of Loss; LCM = Lack of Countermeasure; Opt = Optimize to; Res. Risk = Residual Risk;
Vulnerab. = Vulnerability.
Total Threat
N/A
Costs
1.00
Criticality
FIGURE 2. MEDIAN DIGITAL FORENSICS RISK METER RESULTS MITIGATED TO 35.83%, CONTINUED
April 2016
Defense ARJ, April 2016, Vol. 23 No. 2 : 152–177
159
A Publication of the Defense Acquisition University
http://www.dau.mil
Vulnerabilities, Threats, and
Countermeasures
Based on industry best practices guidelines, such as the U.S. Department
of Justice (2004) Forensic Examination of Digital Evidence: A Guide for Law
Enforcement, eight specific vulnerabilities are assessed:
1. Protocols and Procedures
2. Evidence Assessment
3. Evidence Acquisition
4. Evidence Examination
5. Documentation and Reporting
6. Digital Forensics Tools
7.
Legal Aspects
8. Victim Relations
Within each vulnerability category, questions pertain to specific threats and
countermeasures. For example, within the Evidence Acquisition vulnerability, respondents are asked questions regarding precautions, protection,
and preservation threats and countermeasures. Within the Evidence
Examination vulnerability, respondents are asked questions regarding
preparation, physical extraction, logical extraction, timeframe analysis,
data hiding analysis, application/file analysis, and ownership/possession
threats and countermeasures. Within the digital forensics Tools vulnerability, respondents are asked questions regarding hardware, software, training,
and funding threats and countermeasures. Figure 1 details these vulnerabilities and threats. The responses are then used to generate a quantitative
Digital Forensics risk index.
Assessment Questions
Questions are designed to elicit responses regarding the perceived risk
to proper Digital Forensics procedures, evidence handling/examination,
admissibility, and other associated issues from particular threats, as well
as the countermeasures the respondents may employ to counteract those
160
Defense ARJ, April 2016, Vol. 23 No. 2 : 152–177
April 2016
threats. For example, in the Evidence Examination vulnerability, questions
regarding the data hiding analysis threat include both threat and countermeasure questions. Threat questions would include:
•
Do file headers not correspond to file extensions?
•
Did the suspect encrypt or password-protect data?
•
Are hidden messages present?
•
Are host-protected areas (HPA) present?
Countermeasure questions would include:
•
Did the examiner correlate file headers to the corresponding
file extensions to identify any mismatches that may indicate
the user intentionally hid data?
Defense ARJ, April 2016, Vol. 23 No. 2 : 152–177
161
A Publication of the Defense Acquisition University
http://www.dau.mil
•
Did the examiner gain access to all password-protected,
encrypted, and compressed files, which may indicate an
attempt to conceal the data from unauthorized users?
•
Did the examiner conduct a thorough stenographic analysis?
•
Did the examiner gain access to HPAs that may indicate an
attempt to conceal data?
Sample vulnerability (Evidence Acquisition) assessment questions
employed in the digital forensics risk meter are found in Appendix A.
Appendix A also clarifies and precludes confusion between Evidence
Acquisition and materiel acquisition. The first proactive step in any digital forensic investigation is acquisition. The inherent problem with digital
media is that it is readily modified just by accessing files. Working from
a copy is one of the fundamental steps to making a forensic investigation
auditable and acceptable to a court (Acquisition, n.d.).
Risk Calculation and Risk Management
through Surveys
Based on their experience, the respondents answer yes or no to the
survey questions. These responses are then used to calculate residual risk.
Employing a game-theoretical mathematical approach, the calculated risk
index is used to generate an optimization or lowering
of risk to desired levels (Sahinoglu, 2007, 2016).
A more detailed set of mitigation advice will be
generated to show interested parties (such as investigators, administrators, and officers of the court)
where risk can be reduced to optimized or desired
levels. An example of such risk reduction is shown
in Figure 2, from 45.8 percent to 35.8 percent,
which represents the median response from the
study participants (Sahinoglu, Cueva-Parra, & Ang,
2012). Figure 2 is an actual screenshot of a results
table, representing the median digital forensics risk
meter results displaying threat, countermeasures,
residual risk indices, optimization options, and
risk mitigation advice. For this study, a random
sample of responses from 27 survey participants was analyzed; their residual
162
Defense ARJ, April 2016, Vol. 23 No. 2 : 152–177
April 2016
risk results are tabulated and presented in Appendix B. The survey portfolio used in this assessment and upon which this research article is based
showed the complexity of the digital forensics field, encompassing tools,
procedures, specific training, budget, and trial.
Digital forensics has two crucial phases (Appendix A). The first phase
included all the forensics involved with the collection of data, while the
second phase concerns defending the data collected, the means by which
the data were collected, and chain of custody applied from the original
collection until court (Sahinoglu, Stockton, Morton, Barclay, & Eryilmaz,
2014). The initial goal was to obtain survey input from local city leaders in
Montgomery, Alabama. Although individuals from the Governor’s Office,
Montgomery Police Department, and District Attorney’s office were willing to assist, our short timeframe and their busy schedules prevented their
offices from providing input to the digital forensics survey. Fortunately, the
authors had contacts at other law enforcement offices, which agreed to make
personnel available for the survey and eventual follow-up. Eventually, three
law enforcement offices and one special investigation/training organization
participated and provided valuable input.
Our first objective was to explain the purpose of the survey and the potential
value the combined results could offer each of the offices. At each location,
participants included investigators, initial responders, digital forensics
specialists, and legal experts (i.e., District Attorney Office personnel).
The range of expertise of the participants was invaluable, as each provided insight into an aspect of the survey that is often
unique to a position within a department. Because
of this range of expertise, the authors are confident
they were able to capture the three main components
of the survey portion of the Risk-o-Meter (RoM).
Perspectives from collection of evidence, packaging
of evidence for trial, and presentation of evidence at
trial were all given. Although the special investigation/training organization had many fewer survey
participants, they did offer a unique perspective, as
they represented an organization that focuses on
training digital forensics experts for the military.
The results were then run for each participant,
determining the Initial Repair Cost to Mitigate.
This was determined by using a Criticality
of 1.0, Equipment Cost of $0.0, and a
Defense ARJ, April 2016, Vol. 23 No. 2 : 152–177
163
A Publication of the Defense Acquisition University
http://www.dau.mil
Production Cost of $1,000. The median of all results was determined and
then optimized through the RoM to determine the best “bang for the buck”
that would reduce the participant’s Total Residual Risk by 10 percent. The
initial Total Residual Risk for the median participant was 45.8 percent, with
an Expected Cost of Loss (ECL) of $458.34. Once optimized, the Total Risk
was reduced to 35.8 percent, and the ECL was reduced by $100 to a total
ECL of $358.34 (Figure 2). The first optimized solution was to increase
the countermeasure (CM) capacity for the “Examiner Notes” threat for
the Documentation and Reporting vulnerability from 45.0 percent to 72.17
percent, for an improvement of 27.17 percent. The second optimized solution
was to increase the CM capacity for the “Victim Rights and Support” threat
for the Victim Relations vulnerability from 72.50 percent to 99.92 percent,
for an improvement of 27.42 percent.
Table B-2 in Appendix B depicts
a set of constra ined linea r
equations used within the body
of the risk meter’s innovative
second-stage software for the
game-theoretic optimization
necessary to create the Advice
column (shown on the right in
Figure 2). The Advice column’s
original survey calculations are
depicted in Figure B-1, which
displays company ECSO8: 14th
Ranked Overall Median Survey.
This is followed by Figure B-2,
which displays company OPD1’s
Group Median Survey Taker’s
Original Survey Outcome; while Figure B-3 displays company AUPD5’s
Group Median Survey Taker’s Original Survey Outcome. In each case, the
company representative seemed impressed with the results and noted the
results for possible future implementation. One organization actually commented that they had already begun looking into increases in at least one
CM that was identified by the optimization. Clearly, this episode validated
the tool and its usefulness in their eyes.
164
Defense ARJ, April 2016, Vol. 23 No. 2 : 152–177
April 2016
Discussion and Conclusions
The advantages of conducting business on the Internet have been well
documented. Conducting business online is frequently faster and cheaper
than utilizing traditional methods. However, this comes with the digital
forensics-related vulnerabilities and pertinent threats that tend to convert
the positive advantages to clear disadvantages as a result of fraud and
wrongdoing. With the advent of the Internet and burgeoning information
systems, digital forensics has gained worldwide momentum. In every environment, the content of digital information relative to criminal undertakings
and investigations alike has vastly increased, growing disproportionately
to the capacities of state and local governments, as well as federal agencies
and military components. The risk assessment, risk mitigation, or general
risk management that involve planned investment policy in order of priority,
with a sound and auditable, cost-effective approach, are missing links. The
proposed digital forensics risk meter is an innovative initiative that provides
a quantitative assessment of risk to the user as well as recommendations
for mitigating that risk. This approach will be a highly useful tool to interested parties such as investigators, company or system administrators, and
officers of the court seeking to minimize and thereby mitigate digital forensics risk by leveraging and introducing early, preventive CMs identified as
an outcome of this dynamic closed-end survey.
This approach will be a highly useful tool to interested
parties such as investigators, company or system administrators, and officers of the court seeking to minimize
and thereby mitigate digital forensics risk by leveraging
and introducing early, preventive CMs identified as an
outcome of this dynamic closed-end survey.
Additional future research by the principal author will involve the addition
of cloud computing concerns such as service provider cooperation and data
accessibility, as well as the incorporation of new questions so as to better
refine user responses and subsequent calculation of risk…
Purchase answer to see full
attachment