Computer Sciences Commons^™

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Internet Protocol Geolocation: Development Of A Delay-Based Hybrid Methodology For Locating The Geographic Location Of A Network Node, John M. Roehl

Theses and Dissertations

Internet Protocol Geolocation (IP Geolocation), the process of determining the approximate geographic location of an IP addressable node, has proven useful in a wide variety of commercial applications. Commercial applications of IP Geolocation include market research, redirection for performance enhancement, restricting content, and combating fraud. The potential for military applications include securing remote access via geographic authentication, intelligence collection, and cyber attack attribution. IP Geolocation methods can be divided into three basic categories based upon what information is used to determine the geographic location of the given IP address: 1) Information contained in databases, 2) information that is leaked during …

Geospatial Informational Security Risks And Concerns Of The U.S. Air Force Geobase Program, Scott A. Bryant

Theses and Dissertations

Technological advancements such as Geospatial Information Systems (GIS) and the Internet have made it easier and affordable to share information, which enables complex and time sensitive decisions to be made with higher confidence. Further, advancements in information technology have dramatically increased the ability to store, manage, integrate, and correlate larger amounts of data to improve operational efficiency. However, the same technologies that enable increased productivity also provide increased capabilities to those wishing to do harm. Today’s military leaders are faced with the challenge of deciding how to make geospatial information collected on military installations and organizations available to authorized communities …

Anti-Forensics And The Digital Investigator, Gary C. Kessler

Australian Digital Forensics Conference

Viewed generically, anti-forensics (AF) is that set of tactics and measures taken by someone who wants to thwart the digital investigation process. This paper describes some of the many AF tools and methods, under the broad classifications of data hiding, artefact wiping, trail obfuscation, and attacks on the forensics tools themselves. The concept of AF is neither new nor solely intended to be used by the criminal class; it also has legitimate use by those who wish to protect their privacy. This paper also introduces the concept of time-sensitive anti-forensics, noting that AF procedures might be employed for the sole …

An Approach In Identifying And Tracing Back Spoofed Ip Packets To Their Sources, Krishnun Sansurooah

Australian Digital Forensics Conference

With internet expanding in every aspect of businesses infrastructure, it becomes more and more important to make these businesses infrastructures safe and secure to the numerous attacks perpetrated on them conspicuously when it comes to denial of service (DoS) attacks. A Dos attack can be summarized as an effort carried out by either a person or a group of individual to suppress a particular outline service. This can hence be achieved by using and manipulating packets which are sent out using the IP protocol included into the IP address of the sending party. However, one of the major drawbacks is …

An Overview And Examination Of Digital Pda Devices Under Forensics Toolkits, Krishnun Sansurooah

Australian Digital Forensics Conference

Personal Digital Assistants most commonly known as PDAs are becoming more and more fashionable and affordable in the working environment. With the advent and rapidly increasing technology these handled devices are now targeted by a lot of person with criminal intentions. But unfortunately crime does not choose its technology and nowadays those ultra light handhelds are getting more and more involved in crimes. This therefore become an onerous task for the forensics examiners who needs the proper forensics tools to investigate the information held on these devices. The purpose of this report will browse the current forensics toolkits available and …

Profiling Through A Digital Mobile Device, Lee Fueng Yap, Andy Jones

Australian Digital Forensics Conference

Mobile digital devices have evolved from telecommunications device to a lifestyle product over the years. These devices are used in all aspects of our daily life. As a result, more information is stored within the devices. Unprotected mobile digital device is susceptible to privacy invasion attack when the device falls into the wrong hand of any unscrupulous third party. The main objective of this paper is to provide an implication analysis on the possible risks of information leakage through digital mobile devices, in the case when users forget to, or choose never to apply any security protection to their devices

The Effectiveness Of Investigative Tools For Secure Digital (Sd) Memory Card Forensics, Haitham Al-Hajri, Patricia Williams

Australian Digital Forensics Conference

There are many freeware based tools that can be downloaded from the World Wide Web. This paper reports the retrieval results of using these tools on digital images which have been deleted from Secure Digital (SD) cards. Since SD cards and USB flash drives are considered solid state technology, the tools selected are specifically for solid state drives. This research helps classify the selection of the most effective freeware tools that could be used to recover lost or deleted images. Further, it includes some of the issues that would face forensic examiners undertaking such investigations. The tools were tested using …

Hardware Virtualization Applied To Rootkit Defense, Douglas P. Medley

Theses and Dissertations

This research effort examines the idea of applying virtualization hardware to enhance operating system security against rootkits. Rootkits are sets of tools used to hide code and/or functionality from the user and operating system. Rootkits can accomplish this feat through using access to one part of an operating system to change another part that resides at the same privilege level. Hardware assisted virtualization (HAV) provides an opportunity to defeat this tactic through the introduction of a new operating mode. Created to aid operating system virtualization, HAV provides hardware support for managing and saving multiple states of the processor. This hardware …

Beyond Passswords: Usage And Policy Transformation, Alan S. Alsop

Theses and Dissertations

The purpose of this research is to determine whether the transition to a two-factor authentication system is more secure than a system that relied only on what users “know” for authentication. While we found that factors that made passwords inherently vulnerable did not transfer to the PIN portion of a two-factor authentication system, we did find significant problems relating to usability, worker productivity, and the loss and theft of smart cards. The new authentication method has disrupted our ability to stay connected to ongoing mission issues, forced some installations to cut off remote access for their users and in one …

Implementation And Optimization Of The Advanced Encryption Standard Algorithm On An 8-Bit Field Programmable Gate Array Hardware Platform, Ryan J. Silva

Theses and Dissertations

The contribution of this research is three-fold. The first is a method of converting the area occupied by a circuit implemented on a Field Programmable Gate Array (FPGA) to an equivalent as a measure of total gate count. This allows direct comparison between two FPGA implementations independent of the manufacturer or chip family. The second contribution improves the performance of the Advanced Encryption Standard (AES) on an 8-bit computing platform. This research develops an AES design that occupies less than three quarters of the area reported by the smallest design in current literature as well as significantly increases area efficiency. …

Recommendations For A Standardized Program Management Office (Pmo) Time Compliance Network Order (Tcno) Patching Process, Michael Czumak Iii

Theses and Dissertations

Network security is a paramount concern for organizations utilizing computer technology, and the Air Force is no exception. Network software vulnerability patching is a critical determinant of network security. The Air Force deploys these patches as Time Compliance Network Orders (TCNOs), which together with associated processes and enforced timelines ensure network compliance. While the majority of the network assets affected by this process are Air Force owned and operated, a large number are maintained by external entities known as Program Management Offices (PMOs). Although these externally controlled systems provide a service to the Air Force and reside on its network, …

On-Demand Key Distribution For Mobile Ad-Hoc Networks, Daniel F. Graham

Theses and Dissertations

Mobile ad-hoc networks offer dynamic portable communication with little or no infrastructure. While this has many benefits, there are additional shortcomings specific to wireless communication that must be addressed. This research proposes gossip-based on-demand key distribution as a means to provide data encryption for mobile ad-hoc networks. This technique uses message keys to avoid encrypting and decrypting a message at every node. Other optimizations used include secure channel caching and joint rekey messages. The use of gossip makes the scheme robust to node failure. Experimental results show only a 15% increase in end-to-end delay with a node failure rate of …

Privacy-Preserving Credentials Upon Trusted Computing Augmented Servers, Yanjiang Yang, Robert H. Deng, Feng Bao

Research Collection School Of Computing and Information Systems

Credentials are an indispensable means for service access control in electronic commerce. However, regular credentials such as X.509 certificates and SPKI/SDSI certificates do not address user privacy at all, while anonymous credentials that protect user privacy are complex and have compatibility problems with existing PKIs. In this paper we propose privacy-preserving credentials, a concept between regular credentials and anonymous credentials. The privacy-preserving credentials enjoy the advantageous features of both regular credentials and anonymous credentials, and strike a balance between user anonymity and system complexity. We achieve this by employing computer servers equipped with TPMs (Trusted Platform Modules). We present a …

Malicious Kgc Attacks In Certificateless Cryptography, Man Ho Au, Jing Chen, Joseph K. Liu, Yi Mu, Duncan S. Wong, Guomin Yang, Guomin Yang

Research Collection School Of Computing and Information Systems

Identity-based cryptosystems have an inherent key escrow issue, that is, the Key Generation Center (KGC) always knows user secret key. If the KGC is malicious, it can always impersonate the user. Certificateless cryptography, introduced by Al-Riyami and Paterson in 2003, is intended to solve this problem. However, in all the previously proposed certificateless schemes, it is always assumed that the malicious KGC starts launching attacks (so-called Type II attacks) only after it has generated a master public/secret key pair honestly. In this paper, we propose new security models that remove this assumption for both certificateless signature and encryption schemes. Under …

Minica: A Web-Based Certificate Authority, James Patrick Macdonell

Theses Digitization Project

The MiniCA project is proposed and developed to address growing demand for inexpensive access to security features such as privacy, strong authentication, and digital signatures. These features are integral to public-key encryption technologies. The audience for whom the software project is intended includes, technical staff requiring certificates for use in SSL applications (i.e. a secure web-site) at California State University, San Bernardino.

Securitycom: A Multi-Player Game For Researching And Teaching Information Security Teams, Douglas P. Twitchell

Journal of Digital Forensics, Security and Law

A major portion of government and business organizations’ attempts to counteract information security threats is teams of security personnel. These teams often consist of personnel of diverse backgrounds in specific specialties such as network administration, application development, and business administration, resulting in possible conflicts between security, functionality, and availability. This paper discusses the use of games to teach and research information security teams and outlines research to design and build a simple, team-oriented, configurable, information security game. It will be used to study how information security teams work together to defend against attacks using a multi-player game, and to study …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

A Methodology For The Forensic Acquisition Of The Tomtom One Satellite Navigation System - A Research In Progress, Peter Hannay

Australian Digital Forensics Conference

The use of Satellite Navigation Systems (SNS) has become increasingly common in recent years. The wide scale adoption of this technology has the potential to provide a valuable resource in forensic investigations. The potential of this resource is based on the ability to retrieve historical location data from the device in question while maintaining forensic integrity. This paper presents a methodology to acquire forensc images of the TomTom One satellite navigation unit. This methodology aims to be comprehensive and straightforward, while maintaining forensic integrity of the original evidence. However, in consideration of the aforementioned methodology, ti should be noted that …

An Ad Hoc Adaptive Hashing Technique For Non-Uniformly Distributed Ip Address Lookup In Computer Networks, Christopher Martinez, Wei-Ming Lin

Electrical & Computer Engineering and Computer Science Faculty Publications

Hashing algorithms have been widely adopted for fast address look-up, which involves a search through a database to find a record associated with a given key. Hashing algorithms transforms a key into a hash value hoping that the hashing renders the database a uniform distribution with respect to the hash value. The closer to uniform hash values, the less search time required for a query. When the database is key-wise uniformly distributed, any regular hashing algorithm (bit-extraction, bit-group XOR, etc.) leads to a statistically perfect uniform hash distribution. When the database has keys with a non-uniform distribution, performance of regular …

Providing A Foundation For Analysis Of Volatile Data Stores, Timothy Vidas

Journal of Digital Forensics, Security and Law

Current threats against typical computer systems demonstrate a need for forensic analysis of memory-resident data in addition to the conventional static analysis common today. Certain attacks and types of malware exist solely in memory and leave little or no evidentiary information on nonvolatile stores such as a hard disk drive. The desire to preserve system state at the time of response may even warrant memory acquisition independent of perceived threats and the ability to analyze the acquired duplicate.

Tools capable of duplicating various types of volatile data stores are becoming widely available. Once the data store has been duplicated, current …

Decrypting The Code Of Ethics: The Relationship Between An Attorney's Ethical Duties And Network Security, Ash Mayfield

Oklahoma Law Review

No abstract provided.

A Grounded Theory Approach To Identifying And Measuring Forensic Data Acquisition Tasks, Gregory H. Carlton

Journal of Digital Forensics, Security and Law

As a relatively new field of study, little empirical research has been conducted pertaining to computer forensics. This lack of empirical research contributes to problems for practitioners and academics alike.

For the community of practitioners, problems arise from the dilemma of applying scientific methods to legal matters based on anecdotal training methods, and the academic community is hampered by a lack of theory in this evolving field. A research study utilizing a multi-method approach to identify and measure tasks practitioners perform during forensic data acquisitions and lay a foundation for academic theory development was conducted in 2006 in conjunction with …

Information Governance: A Model For Security In Medical Practice, Patricia A. Williams

Journal of Digital Forensics, Security and Law

Information governance is becoming an important aspect of organisational accountability. In consideration that information is an integral asset of most organisations, the protection of this asset will increasingly rely on organisational capabilities in security. In the medical arena this information is primarily sensitive patient-based information. Previous research has shown that application of security measures is a low priority for primary care medical practice and that awareness of the risks are seriously underestimated. Consequently, information security governance will be a key issue for medical practice in the future. Information security governance is a relatively new term and there is little existing …

Book Review: Conquest In Cyberspace: National Security And Information Warfare, Gary C. Kessler

Journal of Digital Forensics, Security and Law

This is the Book Review column for the JDFSL. It is an experiment to broaden the services that the journal provides to readers, so we are anxious to get your reaction. Is the column useful and interesting? Should we include more than one review per issue? Should we also review products? Do you have suggested books/products for review and/or do you want to write a review? All of this type of feedback -- and more -- is appreciated. Please feel free to send comments to Gary Kessler ([email protected]) or Glenn Dardick ([email protected]).

Information Technology Act 2000 In India - Authentication Of E-Documents, R. G. Pawar, B. S. Sawant, A. Kaiwade

Journal of Digital Forensics, Security and Law

The Information Technology Act 2000 has enacted in India on 9th June 2000. This Act has mentioned provision of authentication of electronic document. It is the need of hour at that time that such provision is needed in the Indian Law system, especially for electronic commerce and electronic governance. Electronic commerce”, which involve the use of alternatives to paper based methods of communication and storage information. To do electronic commerce there should be authentication of particular document. The working of internet is the documents are traveling in terms of bits from one destination to other destination, through various media like …

Monitoring And Surveillance In The Workplace: Lessons Learnt? – Investigating The International Legal Position, Verine Etsebeth

Journal of Digital Forensics, Security and Law

When considering the legal implications of monitoring and surveillance in the workplace, the question may be asked why companies deploy computer surveillance and monitoring in the first place. Several reasons may be put forward to justify why more than 80% of all major American firms monitor employee e-mails and Internet usage. However, what most companies forget is the fact that the absence or presence of monitoring and surveillance activities in a company holds serious legal consequences for companies. From the discussion in this paper it will become apparent that there is a vast difference in how most countries approach this …

Education Organization Baseline Control Protection And Trusted Level Security, Wasim A. Al-Hamdani

Journal of Digital Forensics, Security and Law

Many education organizations have adopted for security the enterprise best practices for implementation on their campuses, while others focus on ISO Standard (or/and) the National Institution of Standards and Technology.

All these adoptions are dependent on IT personal and their experiences or knowledge of the standard. On top of this is the size of the education organizations. The larger the population in an education organization, the more the problem of information and security become very clear. Thus, they have been obliged to comply with information security issues and adopt the national or international standard. The case is quite different when …

Network And Database Security: Regulatory Compliance, Network, And Database Security - A Unified Process And Goal, Errol A. Blake

Journal of Digital Forensics, Security and Law

Database security has evolved; data security professionals have developed numerous techniques and approaches to assure data confidentiality, integrity, and availability. This paper will show that the Traditional Database Security, which has focused primarily on creating user accounts and managing user privileges to database objects are not enough to protect data confidentiality, integrity, and availability. This paper is a compilation of different journals, articles and classroom discussions will focus on unifying the process of securing data or information whether it is in use, in storage or being transmitted. Promoting a change in Database Curriculum Development trends may also play a role …

Book Review: No Place To Hide, Gary C. Kessler

Journal of Digital Forensics, Security and Law

This issue presents the second Book Review column for the JDFSL. It is an experiment to broaden the services that the journal provides to readers, so we are anxious to get your reaction. Is the column useful and interesting? Should we include more than one review per issue? Should we also review products? Do you have suggested books/products for review and/or do you want to write a review? All of this type of feedback -- and more -- is appreciated. Please feel free to send comments to Gary Kessler ([email protected]) or Glenn Dardick ([email protected]).