Security metrics - proving you've made a difference

by Simon Biles

About the Author Simon Biles is a founder of Thinking Security Ltd., an Information Security and Risk Management consultancy firm based near Oxford in the UK.

Language is a funny thing – even though we may speak the same basic language, the nuances, construction and vocabulary is very individual. I find listening to my children a wonderful thing – sometimes I hear either my words, or those of my wife, but more often I hear distinct phrases and words that are unique to them. This month, they have challenged me, in an oft played game, to insert words that are uniquely theirs, and not mine, into this column – so, embedded somewhere in the next eight hundred or so words are two words that have been given to me – I’ll publish the name of anyone next month who can tell me which two they are!

Given that two people may interpret any given word in vastly different ways depending on their backgrounds how do we ensure there is a consensus of understanding? We operate in a field that has very definite concepts – true or false, on or off, zero or one – binary choices. There are few shades of uncertainty (all smart comments about quantum computing to /dev/null please) – it’s there or it isn’t, and unless we are called upon to give our opinions as experts, we are bound, at least ethically if not legally, to make statements of fact. I personally find it an immense problem though, that so often there are not really clear definitions of terms – or at least not clear definitions that you can easily present to a customer (or worse, a jury).

To add further problems, for me at least, I subscribe to a code of ethics that prohibits the use of “FUD” in dealing with customers (see http://www.csoonline.com/article/217983/The_FUD_Factor). “Fear, Uncertainty and Doubt” have to be the biggest drivers in Information Security sales as a quick survey of some major security vendors supports:

“… cyber cold war, with critical infrastructures under constant cyberattack causing widespread damage” – McAfee (fear of attack)

“Do you know where your data ends up?” – Checkpoint (uncertainty)

“Today's attackers evade traditional security solutions, leaving your business vulnerable to data theft.” – Symantec (doubt in your “traditional” solution)

Having put up these examples, I had a moment of paranoia and had to check my own website just to be sure – it really is a very easy thing to do - “pas de touché” fortunately!

So where does this leave us?

Read more at http://www.forensicfocus.com/simon-biles

How encryption affected my life

by Dominik Weber

About the Author Dominik Weber is a Senior Software Architect for Guidance Software, Inc.

Encryption and the lack thereof changed my life. In the early 1990’s I realized that encryption is very underused and in the near future it will become essential for most people and companies. At that time, hardly any user encrypted any data. Even in the financial sector, good encryption was applied seldom. Thus, I chose the focus of my Masters in Computer Science to be Cryptography. My thesis was researching the synergistic properties of compressing data before cryptographically hashing it.

When the large forensic company I am currently working for decided to create an Enterprise-Level product, I worked on cryptographic protocol, the Authentication and Encryption Algorithms, their FIPS 140-2 validation and implementation. This took a long time, proving the well-known fact that well designed protection is not a simple or quick task. The proper selection of algorithms, threat modeling, secure coding practices, entropy and key management are just some of the many facets I had to address. Finally my co-inventors and I obtained a patent protecting this intellectual property.

I was very careful because I knew firsthand how disastrous a lack of protection can be - it was the trigger for my divorce...

Read more at http://www.forensicfocus.com/dominik-weber

Peer review: pros and cons

by Chris Hargreaves

About the Author Dr Chris Hargreaves is a lecturer at the Centre for Forensic Computing at Cranfield University in Shrivenham, UK.

Traditional academic publications are peer reviewed, e.g. journal papers and conference proceedings, and there are now many examples of these that specifically cover digital forensics (e.g. Digital Investigation, Journal of Digital Forensic Practice). However, a considerable amount of useful forensic research is available from what are, in traditional academic terms, considered to be less reliable sources of information (including resources such as blogs, non-peer reviewed papers and forum posts). This article highlights the strengths of these media for distributing results of digital forensic research, but also discusses the value that is added when even a brief discussion of the methods used to obtain the results, and an open discussion of the limitations of the research is included when posting results online.

One of the main advantages of peer-reviewed publications in a journal or in conference proceedings is that one or more other people in the field have examined it and they have independently decided that the paper is suitable for publication. This peer-review process ensures that the author has discussed and explained contradictory theories and considered whether the results obtained are general or due to carefully chosen specific experiments. It also ensures that conclusions drawn are well supported by evidence and that enough information is contained for experiments to be repeated and the results verified. The criteria by which a publication can be judged as suitable can vary, but is also likely to include criteria such as technical accuracy, whether the results can be generalised, relevance, timeliness, etc. This process is in place to ensure that the published work has a certain level of quality...

Read more

Survey: ACPO Good Practice Guide for Computer-Based Electronic Evidence

An editorial panel is currently reviewing the ACPO Good Practice Guide for Computer-Based Electronic Evidence and is seeking the views of interested parties from both the law enforcement and private community of users and service providers, the IT sector, and academia . The panel's remit is to update the content to ensure it is current and relevant, and to see if there is any area of digital forensics not included in the guide that would benefit from inclusion. Participants are asked to complete a survey at www.surveymonkey.com/s/YTZVX2W and submit their views.

Neutral examiners

by Craig Ball

About the Author Craig Ball is a Texas lawyer who limits his practice to service as a court-appointed special master and consultant in computer forensics and electronic discovery.

I recently posted an open letter to judges on a blog that caters to an e-discovery audience. I asked judges to stop ordering parties to turn over their systems to the opposing side's computer forensic examiners and argued that most civil forensics work should be reserved to neutral examiners.

Now, while you rush to warm the tar and pluck the feathers, please hear me out.

Yes, most of my work as a computer forensic examiner is done as a neutral, but I do a lot as a partisan on either side of civil cases. Even so, use of a neutral isn't something that uniquely benefits me. It's something any competent, ethical examiner can and should do. What I'm advocating won't hurt you; in fact, it'll likely add to your job satisfaction.

Here's what I posted:

"Your Honors:

I just read another opinion where the Court decided to let one side's computer expert examine an opposing party's computers. The Court seemed more concerned with who would pay for the exam than what its consequences might be.

I'm a lawyer and computer forensic examiner, and I make part of my living doing just the sort of examinations the court ordered. I've done a whole bunch of them. So, while part of me wants to encourage courts to order more forensic exams — and I can surely attest to their efficacy in resurrecting data thought gone and exposing case-making evidence — the angel at my ear requires me to softly whisper, "WHAT THE HECK WERE YOU THINKING, JUDGE?!?..."

Read more at http://www.forensicfocus.com/craig-ball

IFFEE and DoJEE

April 1st sees the announcement of two new organisations for digital forensics professionals. The International Federation of Forensic Examiners in Europe (IFFEE) and the Department of Justice Expert Examiners (DoJEE) group in the US both aim to provide practitioners with a variety of benefits ranging from professional liability insurance to full immunity against prosecution and covert extraction to a country of their choosing. These new organisations are also running a special promotion for the next 24 hours offering new members a complimentary packet of felt tip pens to improve the presentation of their reports - anyone wishing to take advantage of this great offer should email idprefercrayons@iffeeanddojee.com immediately.