IST-Africa Talk Slides Conference Paper May 2016 CITATIONS READS - PDF document

See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/303210806 IST-Africa Talk Slides Conference Paper · May 2016 CITATIONS READS 0 122 3 authors , including: Victor R Kebande Nickson M Karie Malmö University Edith Cowan University 74 PUBLICATIONS 458 CITATIONS 40 PUBLICATIONS 176 CITATIONS SEE PROFILE SEE PROFILE Some of the authors of this publication are also working on these related projects: Social Engineering: Defining the field from Both an Attack and Defence Perspective View project Proactive and Reactive Digital Forensic Technologies View project All content following this page was uploaded by Victor R Kebande on 15 May 2016. The user has requested enhancement of the downloaded file.

Generic Digital Forensic Readiness Model for BYOD using Honeypot Technology Victor R. Kebande Nickson M. Karie, H.S. Venter Information & Computer Security Architecture Research(ICSA) Lab 1 vickkebande@gmail.com , 2 menza06@hotmail.com 2016, Durban, South Africa 11th-13 th May

Introduction The proliferation and mobility trends of digital devices has seen a significant realization of Bring Your Own Device (BYOD) which is a phenomenon that allows employees in an organizational enterprise network to access computing resources through their personal mobile devices irrespective of the location.

Cost-Effectiveness of BYOD • Increased accessibility of personal digital devices in daily business activities. • Reduced hardware maintenance and spending • Reduced software licensing device maintenance ***IT self-sufficiency and comfortability among employees. ***

BYOD Projections & Predictions • International Data Corporation (IDC) -- of the 480 million devices that will be shipped in 2016, 65 per cent will be used by BYOD for enterprise mobility . • Gartner- half of the world’s companies will enforce BYOD by 2017 and companies will no longer provide computing devices to employees. • Juniper Research -employee-owned devices as part of BYOD will increase to a scale of one billion globally by 2018, although same research shows that 80% of the consumer and these devices will remain unprotected

Shortcomings • The development of this technology faces security challenges due to lack of a proactive security model with Digital Forensic capability that is able to plan and prepare before Potential Security Incidents occur in an organization that has enforced BYOD

DF & DFR • DF-science of Investigation (Reactive) • scientifically proven methods to acquire, examine, identify, analyse and present digital evidence from digital sources that may have reliable information to prove or disprove a hypothesis about a security incident. • Forensics has a legal connotation • DFR-Incident Preparedness(Proactive) • capability of achieving preparedness by a way of maximizing an environment’s ability to collect digital evidence while minimizing the cost of conducting a Digital Forensic Investigation (DFI) during post-event response

So How can we achieve DFR ?

• Define the business scenarios • Determine the Evidence Collection Requirement • Collecting and retaining credible information • Planning the Response; • Protecting the Evidence • Accelerate Investigation

ISO/IEC 27043: 2015 • Standard covers information technology, security techniques, incident investigation principles and processes.(Proposed in ICSA Lab) • is an umbrella standard for high-level concepts of DF investigation.

Classes of Digital investigations Readiness process class Initialization process class Concurrent process class Acquisitive process class Investigative process class

Honeypot • Decoy that is put on a network to lure attackers. • Delude attackers who are trying to intrude a network into having to trust it is a legitimate system running full services. • Communicating network of honeypot builds a Honeynet. • information that is related to the attack is collected as an activity which may be used to reconstruct the events if there is need for an investigation.

Proposed DFRM-4-BYOD Model The model is meant to harvest, digitally preserve potential digital evidence based on the digital forensic readiness processes and guidelines that have been highlighted in the ISO/IEC 27043: 2015 standard.

Proposed DFRM-4-BYOD Model • Uses Honeypot as a Forensic Agent that can collect PDE that can be used as admissible evidence in creating a hypothesis that can be used to prove or disprove an incident in a court of law.

High-level View

BYOD Management • BYOD Management-Lay what an organization aims to protect and how control of applications will be done. • BYOD Technology - Represents different techniques on how the BYOD devices are registered, configured, controlled and managed . • Honeyd Agent - Honeyed agent is the honeypot technology that is used to (Delude) & capture the PDE from potential attackers . • People - Users of BYOD devices • Forensic Readiness - Proactive • Digital Forensic Readiness - Reactive

Detailed DFRM-4-BYOD • Detailed DFRM- 4 -BYOD

BYOD Management • Provisioning control services • control, configure and provide services within an organization • authorized to run a service using a specific device that is connected to BYOD network • administrators are able to exercise rights over all aspects of BYOD devices • trusted platform is set for user’s activity to be monitored based on legal considerations

BYOD Technology • Fine grained BYOD policies • pre-incident planning • Honeyed Agent and • DFR process

Forensic Readiness • Monitoring, • Honeyed logging, • Digital preservation • Forensic database. (The general information collected through these logs include: Packet destination, IP address, source, arrival time, protocol used, OS and biometrics used in case.)

Digital Forensic Investigation • Initialization • acquisitive • investigative processes

Sequences of Execution in BYOD Environment

Conclusion • lack of a proactive security model with DF capability that is able to plan and prepare before potential security incidents occurs in BYOD environment. • Authors proposed a generic model with a DFR capability in a BYOD environment that contributes to the body of knowledge . View publication stats View publication stats