Implementing Digital Forensic Readiness
From Reactive to Proactive Process
Jason Sachowski
Dmitri Ivtchenko, Technical Editor
Table of Contents
Copyright
Syngress is an imprint of Elsevier
50 Hampshire Street, 5th Floor, Cambridge, MA 02139, USA
Copyright 2016 Elsevier Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publishers permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods, professional practices, or medical treatment may become necessary.
Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information, methods, compounds, or experiments described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein.
ISBN: 978-0-12-804454-4
British Library Cataloguing in Publication Data
A catalogue record for this book is available from the British Library
Library of Congress Cataloging-in-Publication Data
A catalog record for this book is available from the Library of Congress
For information on all Syngress publications visit our website at https://www.elsevier.com/
Publisher: Todd Green
Acquisition Editor: Chris Katsaropoulos
Editorial Project Manager: Anna Valutkevich
Production Project Manager: Punithavathy Govindaradjane
Designer: Mark Rogers
Preface
The art of war teaches us to rely not on the likelihood of the enemys not coming, but on our own readiness to receive him; not on the chance of his not attacking, but rather on the fact that we have made our position unassailable.
Sun Tzu, The Art of War
Introduction
Regardless of how strong an organization defenses, there will come a time when the weakest link is exposed leading to some type of incident. When that time comes, organizations turn to the highly specialized skills of digital forensic investigators to parse through and extract evidence from the complex volumes of data.
Unfortunately, there are times when an incident occurs and organizations are unable to support the digital investigation process with the electronic data needed to conduct analysis and arrive at credible and factual conclusions. Not only does this slow down the digital investigation process, it also places additional overhead on people and system to reactively identify where relevant electronic data is and work to have it properly collected and preserved to support the investigation. In comparison, the ability to collect and preserve electronic data before something happens enhances the digital investigation process by pro-actively streamlining activates and reducing overhead.
This book has been written from the business perspective of the digital forensics discipline.
This book is not designed to provide detailed technical knowledge of digital forensic science or how to perform digital forensic investigations. This book is written from a nontechnical business perspective and is intended as an implementation guide for preparing your organization to enhance its digital forensic readiness by moving away from being reactive and becoming proactive with investigations.
While the basic principles, methodologies, and techniques of digital forensic science are covered, this book focuses on outliningin detailwhere, what, and how an organization can enhance its people, processes, and technologies to implement effective and proactive digital forensic readiness.
About the Author
Jason has over a decade of experience in digital forensic investigations, secure software development, and information security architecture. He currently manages a team of forensic investigators and data breach analysts for the Bank of Nova Scotia, commonly known as Scotiabank, Canadas third largest and the most international bank.
Throughout his career, Jason has performed hundreds of digital forensic investigations involving enterprise servers, network logs, smartphones, and database systems. Complimentary to his technical experiences, he has also developed and maintained processes and procedures, managed large information security budgets, and governed the negotiation of third-party contracts.
In addition to his professional career, Jason serves as a contributing author and content moderator for DarkReading, a subject matter expert for (ISC)2 professional exam development, and volunteers as an advocate for CyberBullying prevention and CyberSecurity awareness. He holds several information security and digital forensic certifications, including Certified Information Systems Security ProfessionalInformation Systems Security Architecture Professional (CISSP-ISSAP), Certified Cyber Forensics Professional (CCFP), Certified Secure Software Lifecycle Professional (CSSLP), Systems Security Certified Practitioner (SSCP), and EnCase Certified Examiner (EnCE).
Acknowledgments
I would like to most of all thank my wife and my children for showing me that no matter what I do in my lifetime, they will always be my greatest success.
Thank you to my parents for providing me with countless opportunities to become who I am today and for encouraging me to keep pushing my boundaries.
Thank you to my colleagues for allowing me the honor to work with you and for the infinite wisdom and knowledge you have given me.
Lastly, thank you to Blair for opening doors.
Section A
Digital Forensics
Outline
Chapter 1
Understanding Digital Forensics
Abstract
Digital forensics is a discipline that must be practiced consistently to ensure the collection, preservation, and presentation of digital evidence is upheld to legal requirements. It is important that the implementation of digital forensics aligns strategically and its contextual usefulness is well understood.