Question

When it comes to network forensics capability, what are different ways to determine how much cost should be allocated/budgeted for an organization? What are the things/or matters that should be considered?

Answer 1

Network forensics can best be defined as the sniffing, recording, and analysis of network traffic and events. Network forensics are performed in order to discover the source of security incidents and attacks or other potential problems. One key role of the forensic expert is to differentiate repetitive problems from malicious attacks.Different from intrusion detection, all the techniques used for the purpose of network forensics should satisfy both legal and technical requirements. For example, it is important to guarantee whether the developed network forensic solutions are practical and fast enough to be used in high-speed networks with heterogeneous network architecture and devices.

The five rules are that evidence must be:

•Admissible. Must be able to be used in court or elsewhere.

•Authentic. Evidence relates to incident in a relevant way.

•Complete. No tunnel vision, exculpatory evidence for alternative suspects.

•Reliable. No question about authenticity and veracity.

•Believable. Clear, easy to understand, and believable by a jury.

•Whether the theory or technique has been reliably tested.

•Whether the theory or technique has been subject to peer review and publication.

•What is the known or potential rate of error of the method used?

•Whether the theory or method has been generally accepted by the scientific community.

The investigation of a cyber-crime often involves cases related to homeland security, corporate espionage, child pornography, traditional crime assisted by computer and network technology, employee monitoring, or medical records, where privacy plays an important role.There are at least three distinct communities within digital forensics: law enforcement, military, and business and industry, each of which has its own objectives and priorities. For example, prosecution is the primary objective of the law enforcement agencies and their practitioners and is often done after the fact. Military operations' primary objective is to guarantee the continuity of services, which often have strict real-time requirements. Business and industry's primary objectives vary significantly, many of which want to guarantee the availability of services and put prosecution as a secondary objective.

The primary activities of network forensics are investigative in nature. The investigative process encompasses the following:

•Identification

•Preservation

•Collection

•Examination

•Analysis

•Presentation

•Decision