Center for Information Security and Assurance
University of Maryland, Baltimore County

Cloud Forensics and its Many Challenges

Ken Zatyko

Assured Information Security, Inc.

12-1pm, Friday 1 November 2013, ITE 229, UMBC

In this presentation, we present a challenge question for today’s cyber experts, cyber scientists, and cyber analysts. Does Locard’s Exchange Principle apply in digital forensics? The dramatic increase in cybercrime and the repeated cyber intrusions into critical infrastructure demonstrate the need for improved security. The Executive Office of the President noted on May 12, 2011 “cyber threat is one of the most serious economic and national security challenges we face as a nation.” We believe addressing whether or not Locard’s Exchange Principle applies to digital forensics is a fundamental question that can guide or limit the scientific search for digital evidence.

Locard’s Exchange Principle is often stated in forensics publications “every contact leaves a trace…” Essentially Locard’s Exchange Principle is applied to crime scenes in which the perpetrator(s) of a crime comes into contact with the scene. The perpetrator(s) will both bring something into the scene, and leave with something from the scene. In the cyber world, the perpetrator may or may not come in physical contact with the crime scene, thus, this brings a new facet to crime scene analysis. According to the World of Forensic Science, Locard’s publications make no mention of an “exchange principle,” although he did make the observation “Il est impossible au malfaiteur d’agir avec l’intensité que suppose l’action criminelle sans laisser des traces de son passage.” (It is impossible for a criminal to act, especially considering the intensity of a crime, without leaving traces of this presence.)

The term “principle of exchange” first appears in Police and Crime-Detection, in 1940, and was adapted from Locard’s observations. The field of digital forensics can be strictly defined as “the application of computer science and investigative procedures for a legal purpose involving the analysis of digital evidence after proper search authority, chain of custody, validation with mathematics, use of validated tools, repeatability, reporting, and possible expert presentation. (Zatyko, 2007).” Furthermore, digital evidence is defined as information stored or transmitted in binary form that may be relied on in court. (National Institute of Justice, 2004). However, digital forensics tools and techniques have also been used by cyber analysts and researchers to conduct media analysis, compile damage assessments, build timelines, and determine attribution. According to the Department of Defense Cyber Crime Center’s training program, cyber analysts require knowledge on how network intrusions occur, how various logs are created, what is electronic evidence, how electronic artifacts are forensically gathered, and the ability to analyze data to produce comprehensive reports and link analysis charts.

Our hypothesis is that Locard’s Exchange Principle does apply to cyber crimes involving computer networks such as identity theft, electronic bank fraud, or denial of service attacks, even if the perpetrator does not need to physically come in contact with the crime scene. Although the perpetrator may make virtual contact with the crime scene through the use of a proxy machine, we believe he will still “leave a trace” and digital evidence will exist. This presentation will explore with audience input “where in the cloud is digital evidence found” and new ways it can lead to attribution. It will explore what new standards and techniques are needed to find these digital traces. Read ahead information can be found at here.

Ken Zatyko was previously the Director of the Department of Defense Computer Forensics Laboratory where he led the largest accredited, internationally recognized, leading-edge computer forensics laboratory located in Maryland. For several months, Mr. Zatyko has been working with NIST on a working group to further standards and technology to solve cloud forensics challenges. Mr. Zatyko is currently the Vice President of Maryland Operations with Assured Information Security.

Host: Dr. Alan T. Sherman, Sorry, you need javascript to view this email address.

Last night, in the early hours of the morning, we launched a brand new version of Treehouse. Over the past months our team has been rethinking how we structure the Treehouse library and how we can best help students succeed by making everything in our library easy to find and discover, and especially how to guide students through learning when they’re not sure what to work on next.

Here’s a quick video introducing the new update!

Here are a few things that we’re especially proud of:

Tags and Filtering

We’ve tagged everything by its type of content and made it really easy to filter the entire library by choosing the tag you’d like to focus on. Want to brush up on your HTML skills? Filter the library to just HTML and dig on in. Ready to learn JavaScript and jQuery? There’s a filter for that too!

Tracks

Learning adventures are now called Tracks at Treehouse! We think it’s really important, especially for people who are just beginning to learn technology, that they have a helping hand to guide them through the maze of technologies and techniques that are available to learn. That’s where Tracks come in. Whether you want to Become a Web Designer, Learn Ruby on Rails, Learn to Build Android Apps, or so many other skills, there’s a Track to take you from the beginning through what you need to know.

Monitor Your Progress

We’ve added progress bars throughout the app to help you know what you’ve finished and what you have yet to learn. Your dashboard has also been renamed to Home and updated to include more information about what points you’ve earned and what your next learning steps are.

We hope you love it!

We love serving our students, and we felt that this new design was the best way for us to do just that. In the coming months we’ll be building quite a few new features and improvements on the foundation of this new design.

If there’s anything you love or hate, we’d love to hear about it here in the comments below or on the Treehouse Forum. Or, feel free to contact our support team with any questions you have.

The post A Brand New Treehouse appeared first on Treehouse Blog.

This week Nick and Jason share an amazing source of information about responsive design, an amazing rich text editor for the web, and squircles. That’s right, squircles.

This Week’s Links

• Responsive Design Knowledge Hub
• Sir Trevor JS | Made by Many
• UIPlayGround | CSS 3 Icons | CSS 3 Icons Generator | CSS 3 Icons Code Generator
• Git/Github Resources | Brad Frost Web
• Making iOS 7 squircles using CSS3
• hr.js
• Full Screen Mario
• Welcome – Polymer

The post Responsive Design, Rich Text Editing, and Squircles – Treehouse Show Episode 63 appeared first on Treehouse Blog.