forensics as a service and models for forensic brokerage
play

Forensics-as-a-Service and Models for Forensic Brokerage Dr. Keyun - PowerPoint PPT Presentation

Mar 28, 2024 •184 likes •350 views

Forensics-as-a-Service and Models for Forensic Brokerage Dr. Keyun Ruan University College Dublin TAFC/IFIP11.11, 6 June 2013 Malaga, Spain What is Cloud Forensics? Law enforcement perspective Security perspective Traditional

  1. Forensics-as-a-Service and Models for Forensic Brokerage Dr. Keyun Ruan University College Dublin TAFC/IFIP11.11, 6 June 2013 Malaga, Spain

  2. What is Cloud Forensics? • Law enforcement perspective • Security perspective • Traditional digital forensic challenges • Digital forensics in the cloud ecosystem

  3. Organizational Challenges • Split of control • Segregation of duties • Chain of dependencies • Lack of transparency Source: NIST 500-292 Cloud Computing Reference Architecture

  4. Technical Challenges Source: Brenton, C. (2012) ‘Can I Outsource My Security to Source: NIST SP 500-292 the Cloud?’, SANS blog, 19 Jul 2012

  5. Technical Challenges • Hybrid forensic acquisition • Identity and anonymity • Evidence segregation • E-discovery • Instance isolation • Proliferation of endpoints • Time synchronization • Encryption • Data integrity • Interoperability • ... NIST Cloud Computing Forensic Science Working Group: http:// collaborate.nist.gov/twiki-cloud-computing/bin/view/ CloudComputing/CloudForensics

  6. Legal Challenges • Multi Jurisdiction • Multi Tenancy • Data Ownership • Privacy • Service Level Agreement

  7. Survey Results • 257 respondents • Proposed definition: “Cloud Forensics is the application of digital forensic science in cloud computing environments. Technically, it consists of a hybrid forensic approach (e.g., remote, virtual, network, live, large-scale, thin-client, thick-client) towards the generation of digital evidence. Organizationally it involves interactions among cloud actors (i.e., cloud provider, cloud consumer, cloud broker, cloud carrier, cloud auditor) for the purpose of facilitating both internal and external investigations. Legally it often implies multi-jurisdictional and multi-tenant situations. Source: Ruan K., Cathy J. (2013) “Cloud Forensics Definitions and Critical Criteria for Cloud Forensic Capability:an Overview of Survey Results”, Digital Investigation, Elsevier

  8. Source: Ruan K., Cathy J. (2013) “Cloud Forensics Definitions and Critical Criteria for Cloud Forensic Capability:an Overview of Survey Results”, Digital Investigation, Elsevier

  9. Cloud Forensic Investigative Architecture Source: Ruan K., Carthy J. (2012) Cloud Forensic Maturity Model, Proceedings of the 4th International Conference on Digital Forensics & Cyber Crime, Springer Lecture Notes

  10. Source: Ruan K., Carthy J. (2012) Cloud Forensic Maturity Model, Proceedings of the 4th International Conference on Digital Forensics & Cyber Crime, Springer Lecture Notes

  11. FaaS and Cloud Brokerage • Single consistent interface • Business broker, technical broker, or both • Aggregation • Arbitrage • Intermediation Source: NIST SP 500-292

  12. Models for Cloud Forensic Brokerage • Broker for Investigative Key Features: • Elasticity Capability • Broker for Investigative • FaaS Process • Big data/analytics • Broker for Investigative • Standard Interface Toolkit

  13. Key Takeaways • Cloud forensics poses significant challenges in organizational, technical and legal dimensions • Definition of cloud forensics • There are opportunities to be leveraged for cloud forensics including FaaS and standardization acceleration • Cloud Forensic Investigative Architecture • Models for cloud forensic brokerage

  14. My Book • Cybercrime and Cloud Forensics: Applications for Investigation Processes, IGI Global, December 2012: http://www.igi- global.com/book/cybercrime-cloud- forensics/69206

  15. Questions?

  16. Thank you! • @ruankeyun • keyun.ruan@ucd.ie • www.cloudforensicsresearch.org

Recommend

CSN11121/CSN11122 System Administration and Forensics Introduction to Digital Forensic

CSN11121/CSN11122 System Administration and Forensics Introduction to Digital Forensic

CSN11121/CSN11122 System Administration and Forensics Introduction to Digital Forensic 20/10/2011 r.ludwiniak@napier.ac.uk Lecture Objectives 1. History and definition of Digital Forensics 2. Context for an investigation 3. An overview of

1.04k views • 65 slides
Smart Forensic Solutions Role of Forensics in Criminal Justice System Court Proceedings

Smart Forensic Solutions Role of Forensics in Criminal Justice System Court Proceedings

Topic Smart Forensic Solutions Role of Forensics in Criminal Justice System Court Proceedings Analysis of Police Crime Forensic Investigation Evidence EXPECTATIONS Timely Seamless & Evidences get Integrable putrefied, e.g. to

138 views • 9 slides
CSN11121 System Administration and Forensics Web Browser Forensic r.ludwiniak@napier.ac.uk

CSN11121 System Administration and Forensics Web Browser Forensic r.ludwiniak@napier.ac.uk

CSN11121 System Administration and Forensics Web Browser Forensic r.ludwiniak@napier.ac.uk Overview Forensics on Internet Explorer and Firefox Structure Information storage Access to the Information storage Tools used to

1.04k views • 40 slides
Forensics and RCEB Clients Presented by: Sandra Regan , Regional Center of the East Bay Forensic

Forensics and RCEB Clients Presented by: Sandra Regan , Regional Center of the East Bay Forensic

Forensics and RCEB Clients Presented by: Sandra Regan , Regional Center of the East Bay Forensic Service Specialist Jeff Nagafuji , Regional Center of the East Bay Interim Associate Director of Community Placement Plan/ Community Resource

479 views • 19 slides
CSE 469: Computer and Network Forensics Topic 1: Forensics Intro Dr. Mike Mabey | Spring 2019

CSE 469: Computer and Network Forensics Topic 1: Forensics Intro Dr. Mike Mabey | Spring 2019

CSE 469: Computer and Network Forensics Topic 1: Forensics Intro Dr. Mike Mabey | Spring 2019 CSE 469: Computer and Network Forensics General Forensic Science CSE 469: Computer and Network Forensics Definition Forensic Science is the

1.32k views • 90 slides
Forensics Applied Mathematics & Science Course Description Through a forensic simulation,

Forensics Applied Mathematics & Science Course Description Through a forensic simulation,

Forensics Applied Mathematics & Science Course Description Through a forensic simulation, students will apply standards of mathematical and science engineering practices, use measurement, data, and statistics to investigate a crime scene

611 views • 11 slides
Challenges in Digital Forensic Research R.I. Ferguson ian.ferguson@abertay.ac.uk 2 minute

Challenges in Digital Forensic Research R.I. Ferguson ian.ferguson@abertay.ac.uk 2 minute

Challenges in Digital Forensic Research R.I. Ferguson ian.ferguson@abertay.ac.uk 2 minute intro to Digital Forensics Some challenges scale cloud the encryption boundary anti-forensics Digital Forensics in 2 mins

415 views • 7 slides
HACKING PARIS 2014 EXTREME FORENSICS RELOADES 2Q /2014 Alvaro Alexander Soto Digital Forensics

HACKING PARIS 2014 EXTREME FORENSICS RELOADES 2Q /2014 Alvaro Alexander Soto Digital Forensics

HACKING PARIS 2014 EXTREME FORENSICS RELOADES 2Q /2014 Alvaro Alexander Soto Digital Forensics Lab Director HTCIA/ICFP/ACM/IEEE/ACIS/ISSA asoto@asoto.com INTENDED AUDIENCE Forensic lab directors / analysts - Law enforcement - Researchers -

568 views • 36 slides
Thomas Chan Thomas Chan Computer Forensic Investigator EnCE, ACE, CFCE, CBE, A+

Thomas Chan Thomas Chan Computer Forensic Investigator EnCE, ACE, CFCE, CBE, A+

Curriculum Vitae Thomas Chan Thomas Chan Computer Forensic Investigator EnCE, ACE, CFCE, CBE, A+ Licensed Private Detective 14 years in Computer Forensics PC Forensics Executive Inspector General US Postal Inspector

916 views • 53 slides
General-Purpose Image Forensics Using Patch Likelihood under Image Statistical Models The 7th

General-Purpose Image Forensics Using Patch Likelihood under Image Statistical Models The 7th

General-Purpose Image Forensics Using Patch Likelihood under Image Statistical Models The 7th IEEE International Workshop on Information Forensics and Security Wei Fan, Kai Wang, and Franc ois Cayre GIPSA-lab, Grenoble, France 18-11-2015

513 views • 19 slides
Forensic Inves,ga,ons in Cyberspace: what about big data? Katrin

Forensic Inves,ga,ons in Cyberspace: what about big data? Katrin

Computa*onal Forensics Forensic Inves,ga,ons in Cyberspace: what about big data? Katrin Franke Norwegian Information Security Laboratory (NISlab), Department of Computer Science and Media Technology,

587 views • 35 slides
Face Recognition: Some Challenges in Forensics Anil K. Jain, Brendan Klare, and Unsang Park

Face Recognition: Some Challenges in Forensics Anil K. Jain, Brendan Klare, and Unsang Park

Face Recognition: Some Challenges in Forensics Anil K. Jain, Brendan Klare, and Unsang Park Forensic Identification Forensic Identification Apply science to A l i t analyze data for identification identification Traditionally:

336 views • 31 slides
alcohol support groups for forensic inpatient and discharged service users Project lead: Dr

alcohol support groups for forensic inpatient and discharged service users Project lead: Dr

Improving attendance at drug and alcohol support groups for forensic inpatient and discharged service users Project lead: Dr Nikki Wood, Principal Clinical Psychologist and Head of Forensic Substance Use Support Service Project team: SUSS

247 views • 7 slides
Why This Workshop? In 2009 the Research Council of the National Academy of Sciences issues a

Why This Workshop? In 2009 the Research Council of the National Academy of Sciences issues a

Specialized Topics in Ethical Forensic Practice, Part 3: Bias in Forensic Evaluations November 18, 2015 Ohio MHAS Forensic Conference Columbus, OH Terry Kukor, Ph.D., ABPP Board Certified in Forensic Psychology Director of Forensic Services Netcare

972 views • 23 slides
Case Study: Big Data Forensics Case Study: Big Data Forensics Neil Meikle, Associate Director,

Case Study: Big Data Forensics Case Study: Big Data Forensics Neil Meikle, Associate Director,

Ministry of Science, People First, Performance Now Technology and Innovation Case Study: Big Data Forensics Case Study: Big Data Forensics Neil Meikle, Associate Director, Forensic Technology, PwC gy 6 November 2012 Ministry of Science,

570 views • 28 slides
Incident Response and Forensics in your Pyjamas When security incidents happen, you often have to

Incident Response and Forensics in your Pyjamas When security incidents happen, you often have to

Incident Response and Forensics in your Pyjamas When security incidents happen, you often have to respond in a hurry to gather forensic data from the resources that were involved. You might need to grab a bunch of hard drives and physically visit

558 views • 28 slides
Challenges in Crime Scene Investigation Technical challenges in forensic STR profiling

Challenges in Crime Scene Investigation Technical challenges in forensic STR profiling

Epigenetics a New Perspective for Improving Forensic Science p g Hwan Young Lee, Ph.D. Department of Forensic Medicine Yonsei University College of Medicine Current Forensic DNA Typing Forensic cases -- matching suspect with evidence

247 views • 13 slides
Objectives 1. Articulate the rationale for restructuring forensic evaluation reports 2. Identify

Objectives 1. Articulate the rationale for restructuring forensic evaluation reports 2. Identify

11/5/2015 Specialized Topics in Ethical Forensic Practice, Part 1: Restructured Forensic Reports Presented For OhioMHAS Forensic Conference November 18, 2015 Terry Kukor, Ph.D., ABPP (Forensic) Joy Stankowski, M.D. Aracelis (Liz) Rivera, Psy.D.

451 views • 17 slides
forensics tries to reconstruct and explain activities and events their actors and participants

forensics tries to reconstruct and explain activities and events their actors and participants

forensics tries to reconstruct and explain activities and events their actors and participants causes consequences individual forensic procedures in the best case can only provide parts of the puzzle for the whole

299 views • 16 slides
CSE 469: Computer and Network Forensics Topic 2: Evidence Acquisition Dr. Mike Mabey | Spring

CSE 469: Computer and Network Forensics Topic 2: Evidence Acquisition Dr. Mike Mabey | Spring

CSE 469: Computer and Network Forensics Topic 2: Evidence Acquisition Dr. Mike Mabey | Spring 2019 CSE 469: Computer and Network Forensics Acquisition First step in the forensic process: Copy the evidence/data without altering or

629 views • 26 slides
Policies for Cloud Service Brokerage Chenxi Qiu Holcombe Department of Electrical and Computer

Policies for Cloud Service Brokerage Chenxi Qiu Holcombe Department of Electrical and Computer

Towards Green Cloud Computing: Demand Allocation and Pricing Policies for Cloud Service Brokerage Chenxi Qiu Holcombe Department of Electrical and Computer Engineering Outline 1.Introduction 2.Algorithm Design 3.Performance Evaluation

392 views • 20 slides
T and Science of Forensic Monitoring Forensic Monitor may be employed by one Board or a

T and Science of Forensic Monitoring Forensic Monitor may be employed by one Board or a

11/5/2015 The T and Science of Forensic Monitoring Robert N. Baker, PhD Jeannie Cool, PCC-S Lottie Gray, MSSA, LISW, CDCA Julia King, PsyD, MBA T and Science of Forensic Monitoring Has your boss just told you? You are our New Forensic

389 views • 24 slides
Forensic Challenge V2.0 UNAM-CERT RedIRIS Topics * Forensic Challenge V1.0 * Forensic

Forensic Challenge V2.0 UNAM-CERT RedIRIS Topics * Forensic Challenge V1.0 * Forensic

Forensic Challenge V2.0 UNAM-CERT RedIRIS Topics * Forensic Challenge V1.0 * Forensic Challenge V2.0 * Conclusions Introduction Why this forensic Challenge ? * To promote and impulse the Forensic Analysis in our Region -- Hispanoamerica--

558 views • 19 slides
$ Circumventing Forensic Live-acquisition Tools > Rootkits for

$ Circumventing Forensic Live-acquisition Tools > Rootkits for

$ Circumventing Forensic Live-acquisition Tools > Rootkits for dubious defensive purposes > Yonne de Bruijn (yonne.debruijn@os3.nl) Digital Forensics $ retrieve

304 views • 27 slides

More recommend