A Digital Forensic Readiness framework for South African SME's

Abstract

In this digital age, most business is conducted electronically. This contemporary paradigm creates openings for potentially harmful unanticipated information security incidents of both a criminal or civil nature, with the potential to cause considerable direct and indirect damage to smaller businesses. Electronic evidence is fundamental to the successful handling of such incidents. If an organisation does not prepare proactively for such incidents it is highly likely that important relevant digital evidence will not be available. Not being able to respond effectively could be extremely damaging to smaller companies, as they are unable to absorb losses as easily as larger organisations. In order to prepare smaller businesses for incidents of this nature, the implementation of Digital Forensic Readiness policies and procedures is necessitated. Numerous varying factors such as the perceived high cost, as well as the current lack of forensic skills, make the implementation of Digital Forensic Readiness appear difficult if not infeasible for smaller organisations. In order to solve this problem it is necessary to develop a scalable and flexible framework for the implementation of DigitalForensic Readiness based on the individual risk profile of a small to medium enterprise (SME). This paper aims to determine, from literature, the concepts of Digital Forensic Readiness and how they apply to SMEs. Based on the findings, the aspects of Digital Forensics and organisational characteristics that should be included in such a framework is highlighted..

Are you ready? Towards the engineering of forensic-ready systems

“…As a result, researchers have suggested that organisations implement well-defined policies to support forensic readiness [8], [20]. Barske, et al [20] assert that these policies include how systems are monitored, under what conditions data is preserved, data retention times, as well as policies on how investigations are to be undertaken. Rowlingson [8] adds that policies should also cover topics such as identifying data sources, determining data collection and secure data storage.…”

Taxonomy of Challenges for Digital Forensics

“…Barske et al. also add that although the need for digital forensics and digital evidence in organizations has been explored (as has been the need for digital forensic readiness within organizations), decision makers still need to understand what is needed within their organizations to ensure digital forensic readiness.…”

Conceptual forensic readiness framework for infrastructure as a service consumers

“…Digital forensic readiness looks for proactively collecting digital evidence and preparing the infrastructure of the organization in question for reactive digital forensic investigation [39]. As a result, both collecting evidence and preparing infrastructure of the organization for forensics investigation has to be addressed by the digital forensic readiness policy.…”