Search

The wide development of the mobile and virtualised technologies in the past decade has further destabilised the already fragile balance between the defenders and the attackers of computing infrastructures. Coupled with the fact that risk is not controlled by the defenders but by the attackers, it makes no sense to try and re-actively defend computing infrastructures. Apropos, in this new socially driven knowledge-based computing era that corporations are asked to operate in, there is a need to pro-actively defend computing infrastructures by attempting to control the source of the threats that they face. In this paper we discuss forensic readiness issues of such a system and we examine how we could ensure and assure evidential integrity and chain of custody of the near real time intelligence that the system would be collecting.

The wide development of the mobile and virtualised technologies in the past decade has further destabilized the already fragile balance between the defenders and the attackers of computing infrastructures. Criminals employ state of the art techniques for exploiting Information Environments that are making use of these new mediums. Alas, the resources that are available to Law Enforcement Agencies for prosecuting computer criminals are finite and existing investigative methodologies cannot address change in the means and mediums of crime. Coupled with the facts that (a) criminals have the initiative, and (b) they are well aware of the investigative procedures, it is understandable why computer crime, cyber-crime and e-Crime activities continue to be an issue in today’s socially-driven knowledge-based computing era. We argue that it is time to slightly change the focus of the digital forensic investigation from following static methodologies to actively trying to identify evidence of criminal activities. We propose ‘crime-specific’ frameworks that allow transparent extraction of knowledge from evidence, while ensuring chain of custody and evidential integrity. In this paper we critically discuss existing frameworks and build up the case for this new investigative approach.

In this paper we discuss Manoeuvre Warfare operations using cloud computing resources, and how this can be utilised as part of a 21st century information security model used by the modern SME operating at a national and international level. Proactive operations for securing digital assets and embedding a deception strategy within Computer Networks Operations (CNO), can prove to be efficient and cost effective security controls, especially with the exponential increase in highly advanced technology in terms of processing power, storage and application, coupled with the readily available knowledge through the power of the Internet, accessible by all normal users and threat agents alike.

We discuss our research into combat-\ud ting the problem of effectively presenting\ud next to real-time knowledgeable answers to run-time user generated queries, from disparate sources. The paper explores the foundations of our research for the design of an Information Gathering tool based on the Intelligence Domain; focusing on the exploration of semantic metadata, incorporating ontologies and implementing swarm intelligence theory in the conceptualisation of the system design for the IGUSMON Project, in order to present an �efficient and innovative solution.

The success of cloud computing would not be possible without the advances in virtualization. The basic concept is to have one resource pretend to be another. Its implementation is applicable to many areas of computing. Virtualization allows a computer to become several different computers, or one software package to emulate another.\ud Although virtualization technology has been around for many years, it is only now beginning to be fully deployed. One of the reasons for this is the increase in processing power and advances in hardware technology. As the benefits of virtualization are realised, we can observe the benefits to a wide range of users, from IT professionals, to large businesses and government organizations.\ud Firstly this paper aims to discuss the key technology behind virtualisation, secondly analyse current threats and vulnerabilities, and finally propose corresponding countermeasures of Virtualisation threats and vulnerabilities, in order to facilitate the implementation of Virtualization Technologies for organizations.

In 2010/11 the Welsh Government’s Information and Records Management engaged in a Digital Continuity Project. We engaged a research team from the University of Wales Newport (UWN) to conduct a Proof of Concept project. Guidance Software Inc has provided the eDiscovery software used by the research team. \ud \ud The aim of the project was to find out what “unstructured information” and records the Welsh Assembly held, where they were and to identify steps which could be put into place to ensure the digital continuity of unstructured information needed to do business and to dispose of information no longer needed. \ud \ud In our presentation today, Stilianos and I will be telling how the project mined, categorised and classified (based on a pan-governmental vocabulary) a sample data set information) from a heterogeneous large scale computer infrastructure and store/fuse the search results in a forensically sound manner while destroying the duplicates and without disrupting daily staff operations.

Fujitsu is set to bring high-performance computing (HPC) to Wales. They will provide a distributed grid which is a project set over five-years costing up to £40 million. The grid will include over 1400 nodes which is spread across more than eight sites, linked using Fujitsu’s middleware technology SynfiniWay which will deliver an aggregated performance of more than 190 petaflops. Knowledge Grids are self-explanatory; their purpose is to share knowledge. At this day and age we have come to a point where we are using computers to create vast amount of data. The information overload is so big that human beings are not able to analyse that data in a timely manner and extract the much seeked knowledge that will allow to further science and better our lives. We are at a point where we now have to teach computers how to extract knowledge from raw data.

In 2007 the UK government identified several objectives for improving the storage of public sector information. In particular, and of direct relevance to this project, it wanted to:\ud improve the responsiveness to demands for public sector information\ud ensure the most appropriate supply of information for reuse\ud improve the supply of information for reuse\ud promote the innovative use of public sector information.\ud \ud The aim of this project was to mine, categorise and classify information from a heterogeneous large-scale computer infrastructure and then store the search results in a forensically sound manner. Duplicate information was to identified for destruction and the process designed so that it could be implemented without disrupting staff operations.\ud The test data was a a 217Gb (810,000 files) sample taken from the Welsh Government (WG) shared drives and email vault. The records concerned largely related to the work of the Department of Education and Skills though 25% of the sample were taken from the wider organisation in order to ensure that the classification system used were useful over a broad range of subjects. The test data was stored in an isolated test environment with virtualised structures. All development work within the project occurred within the test environment.\ud \ud De-duplication of the test data was achieved. Some 35.88% of the files were identified as duplicates. Removing these files resulted in a saving of 29.49% of physical space. After one pass of the data, it was possible to generate usable metadata for 75.7% of the de-duplicated data set. This became the rich data set. The retention policies of the WG were used to design queries and rules for analysing the rich data set.\ud \ud It was possible to extract 65% of the files in the rich data-set for long-term retention together with their metadata in a format that would allow transfer to the WG Electronic Document and Record Management System (ERDMS Know as iShare within the WG). This translates to 55% of the de-duplicated data set. Further analysis of the rich data set would have produced a better extraction rate. This would have been further facilitated by the use of knowledge extraction applications such as Pingar.

Digital forensics is a multi-disciplinary applied science governed by strict and rigorous rules and regulations. Individuals pursuing a career in this discipline are required to have an interdisciplinary background drawing elements of practical experience from fields as varied as sociology, psychology, forensic science, computing and the law. Despite the above, there is no professional body or QA benchmarks that specifically govern education in this science. The subject area has proved popular and where the profession has traditionally been limited to a select circle of individuals from specific industry sectors, it is now open to all. To meet this demand, many product vendors and Higher Education establishments have developed programmes ranging from short training courses to full undergraduate and postgraduate degree programmes. All these educational offerings promote the fact that individuals will be trained to an appropriate level, however without clear benchmark or regulatory guidance, students face the risk of being ill-equipped for the challenges presented in industry. The challenge faced by educators is to train individuals, many of whom have no prior theoretical or practical experience in the aforementioned fields, to become digital forensic investigators. This paper discusses the approach used at the University of Wales, Newport to overcome this challenge. It demonstrates how industry requirements have influenced and shaped the learning styles adopted by the teaching team in order to produce high calibre graduates that are ready to engage in a career in digital forensics