Agile Approach for IT Forensics Management

TL;DR

This paper introduces the flower model, an agile forensic management approach designed to efficiently handle complex, multi-host cyber attacks and big data challenges in IT incident investigations.

Contribution

The paper presents the novel flower model that applies agile methods to improve forensic investigation processes for advanced cyber attacks.

Findings

The flower model effectively addresses big data challenges in forensic investigations.

It improves the efficiency of analyzing multi-host attacks.

The model ensures evidence collection suitable for court proceedings.

Abstract

The forensic investigation of cyber attacks and IT incidents is becoming increasingly difficult due to increasing complexity and intensify networking. Especially with Advanced Attacks (AT) like the increasing Advanced Persistent Threats an agile approach is indispensable. Several systems are involved in an attack (multi-host attacks). Current forensic models and procedures show considerable deficits in the process of analyzing such attacks. For this purpose, this paper presents the novel flower model, which uses agile methods and forms a new forensic management approach. In this way, the growing challenges of ATs are met. In the forensic investigation of such attacks, big data problems have to be solved due to the amount of data that needs to be analyzed. The proposed model meets this requirement by precisely defining the questions that need to be answered in an early state and collecting only the evidence usable in court proceedings that is needed to answer these questions. Additionally, the novel flower model for AT is presented that meets the different phases of an investigation process.