Towards forensic-ready software systems

Abstract

As software becomes more ubiquitous, and the risk of cyber-crimes increases, ensuring that software systems are forensic-ready (i.e., capable of supporting potential digital investigations) is critical. However, little or no attention has been given to how well-suited existing software engineering methodologies and practices are for the systematic development of such systems. In this paper, we consider the meaning of forensic readiness of software, define forensic readiness requirements, and highlight some of the open software engineering challenges in the face of forensic readiness. We use a real software system developed to investigate online sharing of child abuse media to illustrate the presented concepts. CCS CONCEPTS • Software and its engineering → Requirements analysis; • Applied computing → Evidence collection, storage and analysis;

Towards Automated Logging for Forensic-Ready Software Systems

“…However, this approach suggests collecting digital evidence from existing logs that are found in operating systems, networks, and intrusion detection systems, without considering logs generated by software systems. Pasquale et al [26] tailor the concept of forensic readiness to software engineering as a property that encapsulates the capabilities of the software to conduct digital forensic processes that maximize digital evidence [27] and produces evidence that satisfies the legal scrutiny in a court of law [28]. Alrajeh et al [19] define a framework for evidence preservation requirements of forensic-ready systems.…”

“…This framework ensures that only the minimum amount of data that is relevant to detect a security incident is collected. This work [19], [26] represents a first step towards implementing forensic-ready software systems. However, more effort is necessary to guide the implementation of logging statements inside software systems, to support the detection and investigation of software misuses.…”

“…The ChangeStatus is the other step described in the final UML sequence diagram which corresponds when the manager approves the travel request and it executes inside the HRM software system just one method: save (C). Additionally, to determine where to log and what to log, we consider the requirements to make forensic-ready systems defined by Pasquale et al [26]: a) Relevance: Data preserved proactively should be relevant to potential incident cases and able to support or refute hypotheses explaining how incidents occurred; b) Minimality: Data preserved proactively should be minimal and should not include any information that is unnecessary for an investigation. For our incident example, considering relevance and minimality to make our HRM software system forensic-ready, we determined that the convenient location in HRM software system ( Fig.…”

Analysing system behaviour by automatic benchmarking of system-level provenance

“…The usage of data provenance can apply to security settings and provide evidence in digital forensic investigation. More examples for providing reference and evidence traces for auditing and forensic usage are summarized in Wang and Daniels [158], Pasquale et al [128] and Zhu et al [166] which also show that the traceability, dependability and reproducibility characteristics of data provenance can greatly support forensic usage by providing a chain of evidence and accountable tracing functionality. In Zhou et al [165] and Lee et al [93], the authors also summarized some uses of data provenance for tracing what has happened and who is accountable for certain actions in a network and distributed environment.…”

Automated modelling of security incidents to represent logging requirements in software systems

“…Therefore, developers should implement logging functionalities in software systems that ensure that only key information [10] relevant to security incidents is collected. Logs generated by a software system can provide digital evidence [11] that can explain how an incident occurred [12] and can endure legal scrutiny in a court of law [13,14]. A system able to produce such evidence is so-called forensic-ready [15].…”