Specifying digital forensics: A forensics policy approach

Abstract

PolicyComputer security System specification Forensic properties a b s t r a c t In this paper we present an approach to digital forensics specification based on forensic policy definition. Our methodology borrows from computer security policy specification, which has accumulated a significant body of research over the past 30 years. We first define the process of specifying forensics properties through a forensics policy and then present an example application of the process. This approach lends itself to formal policy specification and verification, which would allow for more clarity and less ambiguity in the specification process.

Secure and Trusted Environment as a Strategy to Maintain the Integrity and Authenticity of Digital Evidence

“…Meanwhile, [47] define a forensics policy as closely related to forensics readiness. Forensics policy and forensics readiness are policies that will encourage an institution to undertake activities which will ensure a minimum cost and maximum environment ability to get digital evidence.…”

A Forensic Framework for Handling Information Privacy Incidents

“…Several researchers have focused on the organizational aspects of forensic readiness. Yasinsac and Manzano [23] have defined policies for computer and network forensics; Wolfe [23] has discussed forensic policies in organizations; Rowlingson [19] has specified a ten step process for implementing forensic readiness; Luoma [13] has proposed the establishment of a multi-disciplinary management team to ensure legal compliance with discovery requests; and Taylor, et al [21] have studied forensic policy specification and its use in forensic readiness.…”

“…Businesses processes do not specify the boundaries for acceptable use. Ideally, acceptable use is specified via policies [21] derived from authoritative sources such as information privacy laws and ethical guidelines. In some instances, eth-ical guidelines (such as the Fair Information Principles) may require the creation of "privacy-specific business processes" that deal with private information.…”

“…Information security has traditionally been concerned with the confidentiality, integrity and availability of information [21]. Information privacy, on the other hand, focuses on the ethical and legal use of information [3].…”

The architecture of a digital forensic readiness management system

“…Organisational policy, such as an overall forensics policy, should form the basis for DFR (Yasinsac & Manzano 2001) (Rowlingson 2005) (Taylor et al 2007). Thus, the staff involved with DFR should have access to the necessary policies to inform their decision making.…”