IST-Africa Talk Slides Conference Paper May 2016 CITATIONS READS - - PDF document

See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/303210806

IST-Africa Talk Slides

Conference Paper · May 2016

CITATIONS READS

122

3 authors, including: Some of the authors of this publication are also working on these related projects: Social Engineering: Defining the field from Both an Attack and Defence Perspective View project Proactive and Reactive Digital Forensic Technologies View project Victor R Kebande Malmö University

74 PUBLICATIONS 458 CITATIONS

SEE PROFILE

Nickson M Karie Edith Cowan University

40 PUBLICATIONS 176 CITATIONS

SEE PROFILE

All content following this page was uploaded by Victor R Kebande on 15 May 2016.

The user has requested enhancement of the downloaded file.

Generic Digital Forensic Readiness Model for BYOD using Honeypot Technology

Victor R. Kebande Nickson M. Karie, H.S. Venter

Information & Computer Security Architecture Research(ICSA) Lab

1vickkebande@gmail.com , 2menza06@hotmail.com

2016, Durban, South Africa 11th-13th May

Introduction

The proliferation and mobility trends of digital devices has seen a significant realization of Bring Your Own Device (BYOD) which is a phenomenon that allows employees in an organizational enterprise network to access computing resources through their personal mobile devices irrespective of the location.

Cost-Effectiveness of BYOD

• Increased accessibility of personal digital

devices in daily business activities.

• Reduced hardware maintenance and spending
• Reduced software licensing device

maintenance ***IT self-sufficiency and comfortability among

• employees. ***

BYOD Projections & Predictions

• International Data Corporation (IDC) --of the 480

million devices that will be shipped in 2016, 65 per cent will be used by BYOD for enterprise mobility .

• Gartner-half of the world’s companies will enforce BYOD by

2017 and companies will no longer provide computing devices to employees.

• Juniper Research -employee-owned devices as part of

BYOD will increase to a scale of one billion globally by 2018, although same research shows that 80% of the consumer and these devices will remain unprotected

Shortcomings

• The development of this technology faces

security challenges due to lack of a proactive security model with Digital Forensic capability that is able to plan and prepare before Potential Security Incidents occur in an organization that has enforced BYOD

DF & DFR

• DF-science of Investigation (Reactive)
• scientifically proven methods to acquire, examine, identify, analyse and present digital evidence from

digital sources that may have reliable information to prove or disprove a hypothesis about a security incident.

• Forensics has a legal connotation
• DFR-Incident Preparedness(Proactive)
• capability of achieving preparedness by a way of maximizing an environment’s ability to collect digital

evidence while minimizing the cost of conducting a Digital Forensic Investigation (DFI) during post-event response

So How can we achieve DFR ?

• Define the business scenarios
• Determine the Evidence Collection

Requirement

• Collecting and retaining credible information
• Planning the Response;
• Protecting the Evidence
• Accelerate Investigation

ISO/IEC 27043: 2015

• Standard

covers information technology, security techniques, incident investigation principles and processes.(Proposed in ICSA Lab)

• is an umbrella standard for high-level

concepts of DF investigation.

Classes of Digital investigations

Initialization process class Acquisitive process class Investigative process class Concurrent process class Readiness process class

Honeypot

• Decoy that is put on a network to lure attackers.
• Delude attackers who are trying to intrude a network into

having to trust it is a legitimate system running full services.

• Communicating network of honeypot builds a Honeynet.
• information that is related to the attack is collected as an

activity which may be used to reconstruct the events if there is need for an investigation.

Proposed DFRM-4-BYOD Model

The model is meant to harvest, digitally preserve potential digital evidence based on the digital forensic readiness processes and guidelines that have been highlighted in the ISO/IEC 27043: 2015 standard.

Proposed DFRM-4-BYOD Model

• Uses Honeypot as a Forensic Agent that can

collect PDE that can be used as admissible evidence in creating a hypothesis that can be used to prove or disprove an incident in a court of law.

High-level View

BYOD Management

• BYOD Management-Lay what an organization aims to protect and how

control of applications will be done.

• BYOD Technology-Represents different techniques on how the

BYOD devices are registered, configured, controlled and managed.

• Honeyd Agent-Honeyed agent is the honeypot technology that is

used to (Delude) & capture the PDE from potential attackers.

• People-Users of BYOD devices
• Forensic Readiness-Proactive
• Digital Forensic Readiness-Reactive

Detailed DFRM-4-BYOD

• Detailed DFRM- 4 -BYOD

BYOD Management

• Provisioning control services
• control, configure and provide services within

an organization

• authorized to run a service using a specific

device that is connected to BYOD network

• administrators are able to exercise rights over

all aspects of BYOD devices

• trusted platform is set for user’s activity to be

monitored based on legal considerations

BYOD Technology

• Fine grained BYOD policies
• pre-incident planning
• Honeyed Agent and
• DFR process

Forensic Readiness

• Monitoring,
• Honeyed logging,
• Digital preservation
• Forensic database.

(The general information collected through these logs include: Packet destination, IP address, source, arrival time, protocol used, OS and biometrics used in case.)

Digital Forensic Investigation

• Initialization
• acquisitive
• investigative processes

Sequences of Execution in BYOD Environment

Conclusion

• lack of a proactive security model with DF

capability that is able to plan and prepare before potential security incidents occurs in BYOD environment.

• Authors proposed a generic model with a

DFR capability in a BYOD environment that contributes to the body of knowledge.