Agile Approach for IT Forensics Management
This work addresses the problem of inefficient forensic analysis for IT security professionals dealing with complex multi-host attacks, presenting an incremental improvement over existing models.
The paper tackles the growing difficulty of forensic investigation in cyber attacks, especially Advanced Persistent Threats, by proposing the novel flower model, an agile forensic management approach that addresses big data challenges by focusing on court-admissible evidence and specific investigative questions.
The forensic investigation of cyber attacks and IT incidents is becoming increasingly difficult due to increasing complexity and intensify networking. Especially with Advanced Attacks (AT) like the increasing Advanced Persistent Threats an agile approach is indispensable. Several systems are involved in an attack (multi-host attacks). Current forensic models and procedures show considerable deficits in the process of analyzing such attacks. For this purpose, this paper presents the novel flower model, which uses agile methods and forms a new forensic management approach. In this way, the growing challenges of ATs are met. In the forensic investigation of such attacks, big data problems have to be solved due to the amount of data that needs to be analyzed. The proposed model meets this requirement by precisely defining the questions that need to be answered in an early state and collecting only the evidence usable in court proceedings that is needed to answer these questions. Additionally, the novel flower model for AT is presented that meets the different phases of an investigation process.