A theoretical framework for organizational network forensic readiness

Journal of Computers

Volumn 2, Issue 3, 2007, Pages 1-11

  Endicott Popovsky, Barbara ^a   Frincke, Deborah A ^b   Taylor, Carol A ^c  

^a University School   (United States)

^b PACIFIC NORTHWEST NATIONAL LABORATORY   (United States)

^c UNIVERSITY OF IDAHO   (United States)

Author keywords

Digital forensics; Network forensics; Networks

Indexed keywords

COMPUTER FORENSICS; ELECTRONIC CRIME COUNTERMEASURES; NETWORKS (CIRCUITS);

BROAD APPLICATION; CASE ANALYSIS; FORENSIC INVESTIGATION; FORENSIC READINESS; ORGANIZATIONAL IMPLEMENTATION; ORGANIZATIONAL NETWORK; RESEARCH QUESTIONS; THEORETICAL FRAMEWORK;

DIGITAL FORENSICS;

EID: 51149091325     PISSN: 1796203X     EISSN: None     Source Type: Journal    
DOI: 10.4304/jcp.2.3.1-11     Document Type: Article

References (48)

1. Tan, J. (2001). "Forensic Readiness, " Cambridge, MA: @Stake.
2. D. Dittrich and Endicott-Popovsky, B.E. (Fall, 2003). "INFO498 Introduction to computer security incident response, " University of Washington, Seattle, WA.
3. Endicott-Popovsky, B and Frincke, D., "Embedding forensic capabilities into networks: addressing inefficiencies in digital forensics investigations" in Proceedings from the Seventh IEEE Systems, Man and Cybernetics Information Assurance Workshop, 21-23 June 2006, United States Military Academy, West Point, NY, pp.133-139.
4. rd Annual IFIP WG 11.9 Conference, January 29-31, Orlando, FL.
5. Orton, I. "Coordinating with law enforcement on security issues, " presented at Computer Security and Cybercrime II: Legal Risks and Responsibilities in a Dangerous World Workshop, King County Bar Association, October 24, 2002, Seattle, WA
6. Endicott-Popovsky, B.E., Frincke, D. "Adding the Fourth 'R': A systems approach to solving the hacker's arms race. " Hawaii International Conference on System Sciences (HICSS) 39 Symposium: Skilled Human-intelligent Agent Performance: Measurement, Application and Symbiosis, 4 January 2006, Kauai, HI, Retrieved Feb. 17, 2007 from the World Wide Web: http://www.itl.nist.gov/iaui/vvrg/hicss39/4_r_s_rev_3_HICSS_ 2006.doc.
7. Carnegie-Mellon Software Engineering Institute CERT Coordination Center. (2007). "CERT/CC Statistics 1988-2006. " Retrieved Feb. 17, 2007 from the World Wide Web: http://www.cert.org/stats/cert_stats.html.
8. Senge, P. M. (1990). The Fifth Discipline. New York: Doubleday Currency.
9. Senge, P., Roberts, C., Ross, R.B., Smith, B.J., & Kleiner, A. (1994). The Fifth Discipline Fieldbook: Strategies and Tools for Building a Learning Organization. New York: Doubleday-Currency.
10. Kim, D. H. (1992). Systems Archetypes I: Diagnosing Systemic Issues and Designing High Leverage Interventions. Waltham, MA: Pegasus Communications, Inc.
11. Kirk Bailey, "Trouble in cyberspace: Why this conference is important, " presented at NWSec, February 15, 2007, Seattle, WA, Retrieved Feb. 17, 2007, from the World Wide Web: http://students.washington.edu/greyhat/mainsec.html
12. CSI/FBI: CSI/FBI. (2005). "Computer crime and security survey, " Computer Security Institute, San Francisco, CA.
13. Ivan Orton, King County Deputy Prosecutor. Personal interviews. August 24, 2006 and September 29, 2006.
14. th Annual Western Protective Relay Conference, 23-26 Oct. ober, 2000, Spokane, WA.
15. Schroeder, S., Federal prosecutor (Retired) (Spring, 2004). CSSE592 Computer forensics: Legal overview, Seattle University, Seattle, Washington.
16. Endicott-Popovsky, B.E., Ryan, D., Frincke, D. (2005). The New Zealand hacker case: "A post mortem, " in Proceedings of the Safety and Security in a Networked World: Balancing Cyber-Rights & Responsibilities Conference at the Oxford Internet Institute, 8-10 September, 2005, The University of Oxford, Oxford, England. Retrieved Feb 17, 2007 from the World Wide Web: http://www.oii.ox.ac.uk/microsites/cybersafety/?view=papers
17. Barton, C. "Hacker destroys 4500 web sites, " New Zealand Herald, November 19, 1998, Retrieved August 13, 2005 from the World Wide Web: http://www.landfield.com/isn/mailarchive/ 1998/Nov/0098.html
18. Wall, T. "Associates denounce website hacker, " New Zealand Herald, November 23, 1998, Retrieved August 13, 2005 from the World Wide Web: http://www.landfield.com/isn/mail-archive/1998/Nov/0098.html
19. thed.) New York: McGraw-Hill.
20. ®"Incident Note IN-98.04: Advanced scanning. " Retrieved August 02, 2005 from the World Wide Web: http://www.cert.org/incident_notes/IN-98.04.html
21. Honeynet Project. (2000). "Know your enemy III: They gain root. " Retrieved August 04, 2005, from the World Wide Web: http://project.honeynet.org/papers/enemy3/index.html
22. Dittrich, D. "Developing an effective incident cost analysis mechanism, " Security Focus, June 12, 2002. Retrieved August 14, 2005 from the World Wide Web: http://online.securityfocus.com/infocus/1592
23. Attfield, P., "Real-world access control systematic failures: Reality or virtual reality, " in Journal Article Workshop, June '05, Ukraine.
24. Schuler, M and P. Attfield. (April 18, 2002). "Seattle FBI briefing: Operation Flyhook, " Boeing Security Forum, Seattle, WA.
25. Koerner, B. "From Russia with Lopht. " Legal Affairs, May 1, 2002. Retrieved August 7, 2005 from the World Wide Web: http://www.newamerica.net/index.cfm?pg=article&DocID=792
26. United States. Department of Justice. "Court proceedings and public-record trial exhibits, " United States v. Vasily Gorshkov. Seattle, WA, September 2001.
27. United States. Department of Justice. "Press release: Russian hacker sentenced. " Newark, NJ, July 25, 2003. Retrieved August 7, 2005 from the World Wide Web: http://www.usdoj.gov/criminal/cybercrime/ivanovSent_NJ.htm
28. Endicott-Popovsky, B.E., Frincke, D. Redefining Computer Security to Include Forensics, Poster session, 8th Annual Recent Advances in Intrusion Detection (RAID) Conference 7-9 September 2005, Seattle, WA.
29. Simon, M. Seminar in Data Security. Preston Gates: Seattle, WA, March 2, 2005.
30. Yasinsac, A. and Manzano, Y. (2001) "Policies to enhance computer and network forensics. " Proceedings of the 2001 IEEE Workshop on Information Assurance and Security. June 2001, United States Military Academy, West Point, NY.
31. Wolfe-Wilson, J. and Wolfe, H.B. (2003) "Management strategies for implementing forensic security measures "[electronic version]. Information Security Technical Report Volume 8, Issue 2, June 2003, pp.55-64.
32. Carrier, B. and Spafford, E. "Getting physical with the digital investigation process, " International Journal of Digital Evidence, vol. 2, 2 [Electronic version] Fall 2003.
33. Rowlinson, R. "Ten steps to forensic readiness, " International Journal of Digital Evidence, Winter 2004, Volume 2, Issue 3.
34. th IEEE International Conference on Distributed Computing Systems Workshops, June 2005, Columbus, Ohio.
35. Schultz, E.E. and Shumway, R. (2002). Incident Response: A Strategic Guide to Handling Systems and Network Security Breaches, Indianapolis, IN: Sams Publishing.
36. Pollit, M. Unit Chief FBI CART (Retired), Personal interview, July 12, 2005, Syracuse, New York.
37. Mocas, S., (2004). "Building theoretical underpinnings for digital forensics research, " Compsec Online: Digital Investigations. Vol. 1, Issue 1.
38. Rogers, M. and K. Siegfried. (2003). "The future of computer forensics: A needs survey, " CERIAS Tech Report 2003-30, Purdue University, Layfayette, IN.
39. Maconachy, V., Schou, C., Ragsdale, D. and D. Welch,. A model for information assurance: an integrated approach,. in Proceedings of the 2nd Annual IEEE Information Assurance Workshop, June 2001, USMA, West Point.
40. th Annual Canadian Computer Security Conference, Ottawa, Ontario, May, 1992; reprinted in DataPro Reports on Information Security, Delran, NJ: McGraw-Hill, 1992.
41. Ellison, R.J., Fisher, D.A., Linger, R.C., Lipson, H.F., Longstaff, T.A. and. N.R. Mead. (May, 1999). "Survivable network systems: An emerging discipline. CMU/SEI 97-TR-013, " Software Engineering Institute, Carnegie-Mellon University, Pittsburgh, PA.
42. Sommers, P. "Emerging problems on digital evidence. " Presented at the Computer Forensics Workshop, September, 2002, University of Idaho, Moscow, ID.
43. th Colloquium. June 2003, Washington, D.C.
44. Grance, T., Hash, J. and Stevens M. (2004). "Security considerations in the information system development life cycle. " U.S. Department of Commerce, NIST Special Publication 800-64. Retrieved from the World Wide Web Feb. 17 2007: http://csrc.nist.gov/publications/nistpubs/index.html
45. Bailey, K., Chief Information Security Officer University of Washington, and Winn, J., Director of the Shidler Center for Law Commerce and Technology, University of Washington, Personal interviews. Seattle, WA March 31, 2006.
46. Simon, M. Chief Technology Officer, Conjungi Corporation, Personal interviews. Conjungi: Seattle, WA, Summer, 2005.
47. Nassir, D. (2000). Network Performance Baselining. MTP: Indianapolis, IN, p.1.
48. W. B. Saunders Harcourt Health Sciences. "Definition: calibration, " Retrieved from the World Wide Web July 31, 2006. http://www.mercksource.com/pp/us/cns/cns_hl_dorlands.jspzQ zpgzEzzSzppdocszSzuszSzcommonzSzdorlandszSzdorlandzSz dmd_c_03zPzhtm