Information Security Commons^™

Assessing Trace Evidence Left By Secure Deletion Programs, Paul Burke, Philip Craiger

Publications

Secure deletion programs purport to permanently erase files from digital media. These programs are used by businesses and individuals to remove sensitive information from media, and by criminals to remove evidence of the tools or fruits of illegal activities. This paper focuses on the trace evidence left by secure deletion programs. In particular, five Windows-based secure deletion programs are tested to determine if they leave identifiable signatures after deleting a file. The results show that the majority of the programs leave identifiable signatures. Moreover, some of the programs do not completely erase file metadata, which enables forensic investigators to extract …

An Attitude And Perception Study Of Wireless Network Usage In Home Environments, Patryk Szewczyk

Theses : Honours

Research on the use of 802.11 wireless networking and wireless security has in the past focused predominantly on corporations who generally have access to resources specifically allocated to computer and network security. Research has also focused on identifying the flaws in wireless network security, and developing stronger and safer methods which may be incorporated. To date there has been a lack of research into determining what the individual at home perceives towards wireless security. As broadband Internet connections are now predominantly chosen, the amount of available bandwidth open to exploitation is significantly higher than the now becoming obsolete dialup connection. …

Book Review: Digital Crime And Forensic Science In Cyberspace, Gary C. Kessler

Journal of Digital Forensics, Security and Law

This issue presents the first Book Review column for the JDFSL. It is an experiment to broaden the services that the journal provides to readers, so we are anxious to get your reaction. Is the column useful and interesting? Should we include more than one review per issue? Should we also review products? Do you have suggested books/products for review and/or do you want to write a review? All of this type of feedback -- and more -- is appreciated. Please feel free to send comments to Gary Kessler ([email protected]) or Glenn Dardick ([email protected]).

Alphaco: A Teaching Case On Information Technology Audit And Security, Hüseyin Tanriverdi, Joshua Bertsch, Jonathan Harrison, Po-Ling Hsiao, Ketan S. Mesuria, David Hendrawirawan

Journal of Digital Forensics, Security and Law

Recent regulations in the United States (U.S.) such as the Sarbanes-Oxley Act of 2002 require top management of a public firm to provide reasonable assurance that they institute internal controls that minimize risks over the firm’s operations and financial reporting. External auditors are required to attest to the management’s assertions over the effectiveness of those internal controls. As firms rely more on information technology (IT) in conducting business, they also become more vulnerable to IT related risks. IT is critical for initiating, recording, processing, summarizing and reporting accurate financial and non-financial data. Thus, understanding IT related risks and instituting internal …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Designing A Data Warehouse For Cyber Crimes, Il-Yeol Song, John D. Maguire, Ki Jung Lee, Namyoun Choi, Xiaohua Hu, Peter Chen

Journal of Digital Forensics, Security and Law

One of the greatest challenges facing modern society is the rising tide of cyber crimes. These crimes, since they rarely fit the model of conventional crimes, are difficult to investigate, hard to analyze, and difficult to prosecute. Collecting data in a unified framework is a mandatory step that will assist the investigator in sorting through the mountains of data. In this paper, we explore designing a dimensional model for a data warehouse that can be used in analyzing cyber crime data. We also present some interesting queries and the types of cyber crime analyses that can be performed based on …

A Forensic Log File Extraction Tool For Icq Instant Messaging Clients, Kim Morfitt, Craig Valli

Journal of Digital Forensics, Security and Law

Instant messenger programs such as ICQ are often used by hackers and criminals for illicit purposes and consequently the log files from such programs are of interest in a forensic investigation. This paper outlines research that has resulted in the development of a tool for the extraction of ICQ log file entries. Detailed reconstruction of data from log files was achieved with a number of different ICQ software. There are several limitations with the current design including timestamp information not adjusted for the time zone, data could be altered, and conversations must be manually reconstructed. Future research will aim to …

The Design Of An Undergraduate Degree Program In Computer & Digital Forensics, Gary C. Kessler, Michael E. Schirling

Journal of Digital Forensics, Security and Law

Champlain College formally started an undergraduate degree program in Computer & Digital Forensics in 2003. The underlying goals were that the program be multidisciplinary, bringing together the law, computer technology, and the basics of digital investigations; would be available as on online and oncampus offering; and would have a process-oriented focus. Success of this program has largely been due to working closely with practitioners, maintaining activity in events related to both industry and academia, and flexibility to respond to ever-changing needs. This paper provides an overview of how this program was conceived, developed, and implemented; its evolution over time; and …

The Role Of Power And Negotiation In Online Deception, Chad Albrecht, Conan C. Albrecht, Jonathan Wareham, Paul Fox

Journal of Digital Forensics, Security and Law

The purpose of this paper is to advance theoretical understanding of the important role of both power and negotiation during online deception. By so doing, the paper provides insight into the relationship between perpetrator and victim in Internet fraud. The growing prevalence of Internet Fraud continues to be a burden to both society and individuals. In an attempt to better understand Internet fraud and online deception, this article attempts to build an interactive model, based upon the dimensions of power and negotiation from the management and psychology literature. Using the model presented, the article examines the effects of the Internet …

A Curriculum For Teaching Information Technology Investigative Techniques For Auditors, Grover S. Kearns

Journal of Digital Forensics, Security and Law

Recent prosecutions of highly publicized white-collar crimes combined with public outrage have resulted in heightened regulation of financial reporting and greater emphasis on systems of internal control. Because both white-collar and cybercrimes are usually perpetrated through computers, internal and external auditors’ knowledge of information technology (IT) is now more vital than ever. However, preserving digital evidence and investigative techniques, which can be essential to fraud examinations, are not skills frequently taught in accounting programs and instruction in the use of computer assisted auditing tools and techniques – applications that might uncover fraudulent activity – is limited. Only a few university-level …

Development Of A National Repository Of Digital Forensic Intelligence, Mark Weiser, David P. Biros, Greg Mosier

Journal of Digital Forensics, Security and Law

Many people do all of their banking online, we and our children communicate with peers through computer systems, and there are many jobs that require near continuous interaction with computer systems. Criminals, however, are also “connected”, and our online interaction provides them a conduit into our information like never before. Our credit card numbers and other fiscal information are at risk, our children's personal information is exposed to the world, and our professional reputations are on the line.

The discipline of Digital Forensics in law enforcement agencies around the nation and world has grown to match the increased risk and …

Electronic Data Discovery: Integrating Due Process Into Cyber Forensic Practice, John W. Bagby, John C. Ruhnka

Journal of Digital Forensics, Security and Law

Most organizations and government agencies regularly become engaged in litigation with suppliers, customers, clients, employees, competitors, shareholders, prosecutors or regulatory agencies that nearly assures the need to organize, retain, find and produce business records and correspondence, emails, accounting records or other data relevant to disputed issues. This article discusses some high visibility cases that constrain how metadata and content is routinely made available to opposing parties in civil litigation, to prosecutors in criminal prosecutions and to agency staff in regulatory enforcement litigation. Public policy, as implemented in the rules of evidence and pretrial discovery, restrict electronic data discovery (EDD) as …

Forensic Tools For Mobile Phone Subscriber Identity Modules, Wayne Jansen, Rick Ayers

Journal of Digital Forensics, Security and Law

Mobile phones and other handheld devices incorporating cellular capabilities, such as Personal Digital Assistants, are ubiquitous. Besides placing calls, these devices allow users to perform other useful tasks, including text messaging and phonebook entry management. When cell phones and cellular devices are involved in a crime or other incident, forensic specialists require tools that allow the proper retrieval and speedy examination of data present on the device. For devices conforming to the Global System for Mobile Communications (GSM) standards, certain data such as dialed numbers, text messages, and phonebook entries are maintained on a Subscriber Identity Module (SIM). This paper …

Group Key Management In Wireless Ad-Hoc And Sensor Networks, Mohammed A. Moharrum

Computer Science Theses & Dissertations

A growing number of secure group applications in both civilian and military domains is being deployed in WAHNs. A Wireless Ad-hoc Network (WARN) is a collection of autonomous nodes or terminals that communicate with each other by forming a multi-hop radio network and maintaining connectivity in a decentralized manner. A Mobile Ad-hoc Network (MANET) is a special type of WARN with mobile users. MANET nodes have limited communication, computational capabilities, and power. Wireless Sensor Networks (WSNs) are sensor networks with massive numbers of small, inexpensive devices pervasive throughout electrical and mechanical systems and ubiquitous throughout the environment that monitor and …

E-Healthcare In Abc County Health Department (Abcchd): Trade-Offs Analysis And Evaluation, Keng Siau, Hwee-Joo Kam

Research Collection School Of Computing and Information Systems

The issue of privacy stirred a tumultuous uproar when the ABC County Health Department (ABCCHD) was planning for an e-Healthcare system that utilized information technology to streamline the administration process of patients. ABCCHD had hired a software vendor, Info-Health, a company that specialized in information system development for the healthcare industry to help in the project. The privacy of patients with Sexually Transmitted Diseases/Human Immunity System was a thorny issue in the implementation of the e-Healthcare system. A trade-off between privacy and cost was discussed and debated. Three alternatives, with varying degrees of privacy and cost, were considered.

Securing Networks Of Information Age, Bilge Karabacak, Mert Uneri

All Faculty and Staff Scholarship

Internet and IT devices are being used for business and entertainment more frequently. Internet has been becoming a vital part of social fabric. Threats to Internet and other complex commercial networks are solid and growing. Globalization and the need for interoperability complicates security of IT Networks and Internet. Cyber threats have an important potential damage capacity. Proactive security methodologies are needed to protect valuable information. According to the situation described above, the purpose of this paper is to examine the current trends in network security, and to propose a roadmap for protecting information from cyber threats.

Development And Delivery Of Coursework: The Legal/Regulatory/Policy Environment Of Cyberforensics, John W. Bagby, John C. Ruhnka

Journal of Digital Forensics, Security and Law

This paper describes a cyber-forensics course that integrates important public policy and legal issues as well as relevant forensic techniques. Cyber-forensics refers to the amalgam of multi-disciplinary activities involved in the identification, gathering, handling, custody, use and security of electronic files and records, involving expertise from the forensic domain, and which produces evidence useful in the proof of facts for both commercial and legal activities. The legal and regulatory environment in which electronic discovery takes place is of critical importance to cyber-forensics experts because the legal process imposes both constraints and opportunities for the effective use of evidence gathered through …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Is Forensic Computing A Profession? Revisiting An Old Debate In A New Field, Bernd C. Stahl

Journal of Digital Forensics, Security and Law

Forensic Computing is a new and quickly developing field. It is in the process of becoming an academic discipline or sub-discipline with all the features from full undergraduate and postgraduate course provision to conferences and journals. An important question in this process of turning into an established discipline is whether it will coincide with the recognition of the graduates as professionals. This paper hopes to stimulate the debate as to whether forensic computing is or should be a discipline. In order to approach this question, the paper will discuss the concept of forensic computing including the most salient topics of …

Development Of An Ontology Based Forensic Search Mechanism: Proof Of Concept, Jill Slay, Fiona Schulz

Journal of Digital Forensics, Security and Law

This paper examines the problems faced by Law Enforcement in searching large quantities of electronic evidence. It examines the use of ontologies as the basis for new forensic software filters and provides a proof of concept tool based on an ontological design. It demonstrates that efficient searching is produced through the use of such a design and points to further work that might be carried out to extend this concept.

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

The 2006 Analysis Of Information Remaining On Disks Offered For Sale On The Second Hand Market, Andy Jones, Craig Valli, Iain Sutherland, Paula Thomas

Journal of Digital Forensics, Security and Law

All organisations, whether in the public or private sector, use computers for the storage and processing of information relating to their business or services, their employees and their customers. A large proportion of families and individuals in their homes now also use personal computers and, both intentionally and inadvertently, often store on those computers personal information. It is clear that most organisations and individuals continue to be unaware of the information that may be stored on the hard disks that the computers contain, and have not considered what may happen to the information after the disposal of the equipment.

In …

Computer Forensics Field Triage Process Model, Marcus K. Rogers, James Goldman, Rick Mislan, Timothy Wedge, Steve Debrota

Journal of Digital Forensics, Security and Law

With the proliferation of digital based evidence, the need for the timely identification, analysis and interpretation of digital evidence is becoming more crucial. In many investigations critical information is required while at the scene or within a short period of time - measured in hours as opposed to days. The traditional cyber forensics approach of seizing a system(s)/media, transporting it to the lab, making a forensic image(s), and then searching the entire system for potential evidence, is no longer appropriate in some circumstances. In cases such as child abductions, pedophiles, missing or exploited persons, time is of the essence. In …

A Quantitative Method For Iso 17799 Gap Analysis, Bilge Karabacak, Ibrahim Sogukpinar

All Faculty and Staff Scholarship

ISO/IEC 17799:2005 is one of the leading standards of information security. It is the code of practice including 133 controls in 11 different domains. There are a number of tools and software that are used by organizations to check whether they comply with this standard. The task of checking compliance helps organizations to determine their conformity to the controls listed in the standard and deliver useful outputs to the certification process. In this paper, a quantitative survey method is proposed for evaluating ISO 17799 compliance. Our case study has shown that the survey method gives accurate compliance results in a …

Using Prospect Theory To Investigate Decision-Making Bias Within An Information Security Context, Neil J. Schroeder

Theses and Dissertations

Information security is an issue that has increased in importance over the past decade. In this time both practitioner and academic circles have researched and developed practices and process to more effectively handle information security. Even with growth in these areas there has been little research conducted into how decision makers actually behave. This is problematic because decision makers in the Department of Defense have been observed exhibiting risk seeking behavior when making information security decisions that seemingly violate accepted norms. There are presently no models in the literature that provide sufficient insight into this phenomenon. This study used Prospect …

New Efficient Mds Array Codes For Raid Part Ii: Rabin-Like Codes For Tolerating Multiple (>=4) Disk Failures, Gui-Liang Feng, Robert H. Deng, Feng Bao

Research Collection School Of Computing and Information Systems

A new class of Binary Maximum Distance Separable (MDS) array codes which are based on circular permutation matrices are introduced in this paper. These array codes are used for tolerating multiple (greater than or equal to 4) disk failures in Redundant Arrays of Inexpensive Disks (RAID) architecture. The size of the information part is m \times n, where n is the number of information disks and (m+1) is a prime integer; the size of the parity-check part is m \times r, the minimum distance is r+1, and the number of parity-check disks is r. In practical applications, m can be …

Tailored Watermarking Schemes For Authentication Of Electronic Clinical Atlases, Feng Bao, Robert H. Deng, Beng-Chin Ooi, Yanjiang Yang

Research Collection School Of Computing and Information Systems

It is accepted that digital watermarking is quite relevant in medical imaging. However, due to the special nature of clinical practice, it is often required that watermarking not introduce irreversible distortions to medical images. The electronic clinical atlas has such a need of "lossless" watermarking. We present two tailored reversible watermarking schemes for the clinical atlas by exploiting its inherent characteristics. We have implemented the schemes and our experimental results look very promising.

A Block Oriented Fingerprinting Scheme In Relational Database, Siyuan Liu, Shuhong Wang, Robert H. Deng, Weizhong Shao

Research Collection School Of Computing and Information Systems

The need for protecting rights over relational data is of ever increasing concern. There have recently been some pioneering works in this area. In this paper, we propose an effective fingerprinting scheme based on the idea of block method in the area of multimedia fingerprinting. The scheme ensures that certain bit positions of the data contain specific values. The bit positions are determined by the keys known only to the owner of the data and different buyers of the database have different bit positions and different specific values for those bit positions. The detection of the fingerprint can be completed …

Cryptanalysis Of A Forward Secure Blind Signature Scheme With Provable Security, Shuhong Wang, Feng Bao, Robert H. Deng

Research Collection School Of Computing and Information Systems

A forward secure blind signature scheme was proposed by Duc, Cheon and Kim, in ICICS 2003. The security of the scheme was proved to be equivalent to the strong RSA assumption in the random oracle model. In this paper we present an attack to the scheme by forging valid signatures with public keys only. The attack is so efficient that forging a valid signature needs less computation than legally generating a signature, even considering only the user side. Our result implies that the security proof of the scheme must be invalid. Furthermore we point out the fault of the proof …