Information Technology Reference
In-Depth Information
cell phones, digital fax machines, etc.” Digital forensics also involves audit log analy-
sis, and reconstructing or verifying event and transaction details and chronology.
8.12.1
Business Drivers
A business driver may be nonrepudiation for communication (i.e., e-mail) and
transactions (e.g., customer bank withdrawal request or bank teller processing).
This business driver may be the result of legislative requirements. The introduction
of sophisticated cyber-legislation requires sophisticated tools to pursue prosecu-
tion, prove due diligence, and protect the innocent. Business drivers behind digital
forensics may be subtle. For example, U.S. Customs applications log every bor-
der crossing and associate details with the processing Customs agent. The business
driver is to provide trend analysis on border crossings, identify anomalous activity,
and reconstruct chronology and details of historical crossings to identify activity
patterns, including potential collaborative activity at multiple crossing points. To
accurately reconstruct border-crossing activity requires transactional nonrepudia-
tion where agents may not deny an activity in the log.
8.12.2
Compliance Requirements
Compliance requirements include legislation, RFP, CONOPS, and corporate policy.
8.12.2.1 
Legislation
Although no legislation directly requires the application of digital forensics, the
complexity of cyber-crime and cyber-legislation requires the right tools for the right
job; there is an implicit legislative driver behind digital forensics.
8.12.2.2 
RFP
Many RFPs build in the need for digital forensics by requiring transactional nonre-
pudiation, log management, and ability to identify unauthorized, unusual, or illegal
activity; moreover, reconstruct event details and chronology—all forensics activities.
8.12.2.3 
CONOPS
n
Business
Transactional nonrepudiation; user oriented
Event nonrepudiation; process oriented
An Historical Perspective of Digital Evidence , p. 4.
 
Search WWH ::




Custom Search