Cyberspace Forensics Readiness and Security Awareness Model

Abstract

Abstract-The goal of reaching a high level of security in wire-less and wired communication networks is continuously proving difficult to achieve. The speed at which both keepers and violators of secure networks are evolving is relatively close. Nowadays, network infrastructures contain a large number of event logs captured by Firewalls and Domain Controllers (DCs). However, these logs are increasingly becoming an obstacle for network administrators in analyzing networks for malicious activities. Forensic investigators mission to detect malicious activities and reconstruct incident scenarios is extremely complex considering the number, as well as the quality of these event logs. This paper presents the building blocks for a model for automated network readiness and awareness. The idea for this model is to utilize the current network security outputs to construct forensically comprehensive evidence. The proposed model covers the three vital phases of the cybercrime management chain, which are: 1) Forensics Readiness, 2) Active Forensics, and 3) Forensics Awareness.

Simulating SQL-Injection Cyber-Attacks Using GNS3

“…The idea behind this approach is to identify the evidence collection path (ECP) by using evidence collection process model (ECPM). ECPM functions are divided based on the phases in the Cybercrime that has been discussed in [13].…”

Efficiency of network event logs as admissible digital evidence

“…To authenticate evidence, it might also be essential to evaluate its reliability. There are two general methods to evaluating whether evidence can be trusted upon in court [16].The first method is to focus on whether the device that generated the evidence was operative normally without any single issue, and the other method is to examine the actual evidence for manipulation [17].…”

“…METHODOLOGY Figure 4 shows Network Forensics Readiness and Security Awareness Framework. This framework contains fifteen different software and database blocks, these blocks work as single unit in order to forensically process and normalize the captured event-logs that have been discussed in [17]. In order to be able to generate an admissible forensics report to the court of Justice we have to clean our event-logs repository from any duplication and irrelevant information.…”

“…Figure 5 shows an update design of Admissible Network Forensics Correlation Model (ANFCM). The old version of this model has been discussed in [16]. The new update will focus on generating only admissible digital evidence.…”

Cyberspace Challenges and Law Limitations

“…The authors [31], [32] proposed the forensics readiness and awareness framework to reconstruct a cybercrime scenario that was previously observed. The proposed framework that contains fifteen different software and database blocks.…”