Functional Requirements for Adding Digital Forensic Readiness as a Security Component in IoT Environments

Abstract

For every contact made on a digital device, a trace is left behind; this means that every digital device contains some form of electronic evidence that may be associated to the behaviour of the users in a given environment. This evidence can be used to prove or disprove facts if a cyber-incident is detected. However, the world has seen a shift on how devices communicate and connect as a result of increased devices and connectivity, which has led to the creation of "smart environments" where the Internet of Things (IoT) plays a key role. Still, we can harness this proliferation of digital devices and smart environments to Digital Forensic (DF) technology which might help to solve the puzzle of how proactive strategies can help to minimise the time and cost needed to conduct a digital investigation. This article introduces the Functional Requirements (FRs) and processes needed when Digital Forensic Readiness (DFR) process is employed as a security component in the IoT-based environment. The paper serves as a continuation of the initially proposed architecture for adding DFR as a security component to IoT environment. The aspects and claims presented in this paper can be used as basic building blocks for implementing DFR technologies that guarantee security in the IoT-based environment. It is worth noting again that the processes that have been defined in this paper comply with the ISO/IEC 27043: 2015 International Standard.

Towards Development of a Cloud-Connected IoT Forensic Model

“…1. Digital forensic Readiness (DFR): Cloud providers, cloud consumers, as well as IoT devices need to well prepared and evaluated in terms of their proactive forensic capabilities [23], [29], [52]. For instance, as an effective solution to the problem of dependency upon the cloud providers in collecting the forensic data, consumers have the option of readily signing the clearly-drafted forensic oriented Service Level Agreement (SLA) with the provider.…”