This chapter discusses the first step for implementing a digital forensic readiness program as the need to define the business scenarios of why the program is required. By completing a formal business risk assessment, organizations can clearly describe their motives for implementing a digital forensic readiness program.
Introduction
As the first stage, organizations must clearly understand the “who, where, what, when, why, and how” motives for investing their time, money, and resources into implementing a digital forensics readiness program. To better gain this understanding, a risk assessment is performed to identify the potential impacts on business operation from various types of digital crimes, disputes, incidents, and events.
This risk assessment will be used, from the business perspective, to describe where digital evidence is required and its benefit in reducing impact to business operations, such as alleviating effort to reactively collect digital evidence. Generally, if the identified business risks and the potential benefits of a digital forensic readiness program indicate that the organization will realize a positive return on investment (ROI),
1 then there is a need to consider proactively gathering digital evidence to mitigate the identified business risk scenarios.
What Is Business Risk?
Business risk implies a level of uncertainty due to unforeseen events that present a threat
2 to an organization. Generally, business risk is the chance of some event happening that will have an impact to the organization. Business risks can directly or indirectly impact an organization but collectively can be grouped as being influenced by two major types of risk contributors:
• Internal events are those risks that can be controlled and take place within the boundaries of the organization, including, but not limited to:
• technology (ie, outages, degradations)
• workplace health and safety (ie, accidents, ergonomics)
• information/physical security (ie, theft, data loss, fraud)
• staffing (ie, human error, conflict management)
• External events are those risks that occur outside of the organization’s control, including, but not limited to:
• natural disasters (ie, floods, storms, and drought)
• global events (ie, pandemics, climate change)
• regulatory and government policy (ie, taxes, restrictions)
• suppliers (ie, supply chain, business interruptions)
Internal and external events that have potential to impact an organization are subjective depending on the type of business operations offered by an organization (ie, financial, records management) and should not be treated as universally equivalent. Putting these risks into business context, internal and external events can be grouped into five major types of risk classifications:
• Strategic risk is associated with the organization’s core business functions and commonly occurs because of:
• business interactions where goods and services are purchased and sold, varying supply and demand, adjustments to competitive structures, and the emergence of new or innovative technologies.
• transactions resulting in asset relocation from mergers and acquisitions, spin-offs, alliances, or joint ventures.
• strategies for investment relations management and communicating with stakeholder who have invested in the organization.
• Financial risk is associated with the financial structure, stability, and transactions of the organization.
• Operational risk is associated with the organization’s business operational and administrative procedures.
• Legal risk is associated with the need to comply with the rules and regulations of the governing bodies.
• Other risks are associated with indirect, nonbusiness factors such as natural disasters and others as identified based on the subjectivity of the organization.
As part of the overall risk management approach and process, a risk assessment should be completed in order to evaluate:
• vulnerabilities that exist in the environment
• threats targeting organizational assets
• likelihood of threats creating actual impact
• severity of the impact that could be realized
• risk associated with each threat
Without knowing the assets that are most critical and equally what threats, vulnerabilities, or risks can impact the organization, it is not possible for key decision makers to response with appropriate protection strategies.
Appendix G: Risk Management further discusses the overall approach and process for how organizations can complete a risk assessment.
Forensic Readiness Scenarios
Similar to the business risk contributors noted previously, within the context of digital forensic readiness there are also a series of direct and indirect influences that organizations must be identify and develop strategies to manage the exposure to digital evidence. To illustrate the business risks where digital forensic readiness can demonstrate positive benefit, each scenarios will be explained following the “who, where, what, when, why, and how” motives to justify why organizations should invest their time, money, and resources.
Scenario #1: Reducing the Impact of Cybercrime
Having technology play such an integral part of most core business functions increasingly exposes organizations to the potential impact of cybercrime and the constantly evolving threat landscape. Completing a risk assessment for this scenario first requires organizations to understand the security properties of their business functions that they need to safeguard. The list below describes the security properties that organizations have to protect:
•
Confidentiality: Ensuring that objects
3 and assets
4 are only made available to the subjects
5 it is intended for.
• Integrity: Validating that change to objects and assets is done following approved processes and by approved subjects.
• Availability: Guaranteeing that objects and assets are accessible when needed and that performance is delivered to the highest possible standards.
• Continuity: Ability to recovery the loss of processing capabilities within an acceptable period of time.
• Authentication: Establishing that access into objects and assets identifies the requesting subject; or alternatively a risk acceptance is approved to permit alternate means of subject access.
• Authorization: Explicitly denying or permitting subjects access into objects and assets.
• Nonrepudiation: Protects against falsely denying a subjects ownership over a particular action.
Reducing the impact of cybercrime should be a consideration for all security properties noted in the list above. However it is not enough to only consider the security properties that need to be safeguarded, further analysis needs to be done to understand exactly how individual security threats pose business risk and can potentially impact operational functions.
Using a threat modelling methodology, as discussed in
Appendix H: Threat Modelling, allows organizations to become better equipped to identify, quantify, and address security threats that present a risk. Resulting from the threat modelling, a structured representation of the risk(s) can be created into the different ways that threat actors
6 can go about executing attacks and how their tactics, techniques, and procedures
7 can be used to impact the organization.
Table 5.1
Threat Category to Security Property Relationship
| Threat Category | Security Property |
| Spoofing | Authentication |
| Tampering | Integrity |
| Repudiation | Nonrepudiation |
| Information disclosure | Confidentiality |
| Denial of service | Availability, Continuity |
| Elevation of privilege | Authorization |
Detailed information collected from the threat modelling exercise must now be translated into a business language that aligns with strategies for reducing the impact of cybercrime. Using a series of threat categories, individual security threats can be placed into larger groupings based on commonalities in their tactics, techniques, and procedures. As discussed in
Appendix H: Threat Modelling, the STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) threat model describes the six threat categories where individual security threats can be grouped. Illustrated in
Table 5.1, the relationships between security properties and threat categories can be correlated to further enhance the alignment of individual security threat into focus areas for reducing the impact of cybercrime.
Scenario #2: Validating the Impact of Cybercrime or Disputes
When cybercrime occurs, organizations must be prepared to show the amount of impact the incident had to its business operations, functions, and assets. To do so requires that supporting evidence is gathered and made readily available when an incident is declared, which if necessary preparation have not been taken can lead to delayed validation or insufficient results.
The total cost an incident has on an organization should not be limited to only include those business operations, functions, and assets that were directly impacted. To gain a complete and accurate view of the entire cost of an incident, organizations should consider both indirect and collateral contributors as part of validating the impact of cybercrime or disputes.
Mitigating Control Logs
The constantly evolving threat landscape brings about new and transformed cybercrimes which must be identified and assessed to determine its relevance and potential impact. Using the threat tree workflows, such as the one illustrated in
Appendix H: Threat Modelling, organizations can leverage the outputs of “Risk Mitigation Controls” to validate the impact of an incident. Generally, controls can be implemented as either:
• Preventive: stop loss, harm, or damage from occurring
• Detective: monitor activity to identify errors or irregularities
• Corrective: restore objects and information to a known good state
Depending on the type of control there will be different types of log files generated that contain relevant, meaningful, and valuable information for validating the impact of an incident. Regardless of whether the control was implemented as a component (eg, host-based malware prevention) or standalone (eg, network-based firewall) at a minimum the following log file types should be maintained:
• Application: records actions, as predetermined by the application, taken by secondary systems components and processes
• Security: records actions, as chosen by the organization, taken by nonsystem subjects relating to authorization and authentication activities into the system and contained objects
• System: records actions, as predetermined by the system, taken by system components and processes
Overhead Time and Effort
The time it takes to contain and remediate an incident depends on the amount of impact suffered. However, when an incident occurs, the costs associated to the overall business impact are commonly scoped down to the loss, harm, or damage of assets and operations. While these are essential considerations in determining the overall impact of an incident, the overhead cost of managing the incident can sometime be overlooked as a contributor to the overall business impact.
Generally, as a best practice the overhead cost required to run the incident response program should be included in the overall cost of the incident. This requires that organizations maintain accurate time tracking to ensure that the total amount of time invested by resources assigned to the incident response process is recorded. Without tracking overhead costs, organizations cannot effectively demonstrate the resource time and effort required to manage the incident.
Indirect Business Loss
Generally an incident requires a team of specialized resources to participate in one or more of the incident response stages. Additionally, it is not uncommon that resources participating in the incident response process also have daily functions and operations they perform.
Under these circumstances, the time and effort required for these resources to participate in the incident response process creates a cascading effect where other business operations and functions are subsequently impacted by the incident. Through the use of time tracking, the costs associated with the inability to perform normal duties should be taken into consideration as a contributor to the overall impact of the incident.
Recovery and Continuity Expenses
Following the threat tree workflows illustrated in
Appendix H: Threat Modelling, the progression from potential threat into a business impact includes technical impact.
Incidents that generate a technical impact where assets are harmed, lost, or damaged require several steps to ensure the organization’s recovery time objectives (RTO) are met.
In these circumstances, the overall impact of the incident should include disaster recovery and business continuity costs. While the inclusion of these costs is subjective to each organization, at a minimum it should include:
• the overhead time and effort to restore business operations
• indirect productivity loss due to unavailable systems
• new hardware to replace harmed or damaged hardware (if needed)
• restoration of information lost due to harmed or damaged hardware
Scenario #3: Producing Evidence to Support Organizational Disciplinary Issues
For the most part, organizations have a requirement that employees comply with their business code of conduct policy. The organizational goal for having a business code of conduct document is to promote a positive work environment that strengthens the confidence of employees and stakeholders alike.
By signing this document and agreeing to comply, employees will be held to the organization’s level of expectation in how they behave ethically either in the work environment, when performing their operational duties, or as part of their relationship with external stakeholders. Where employees have violated the guidelines set out in the business code of conduct, they could be subject to appropriate disciplinary actions where supporting digital evidence may need to be gathered and processed.
With any disciplinary actions, there is potential that the employee could decide to escalate the situation into a legal matter. To prevent this from happening, the organization must approach the situation fairly and reasonably using consistent procedures that, at a minimum:
• are specific and clear;
• allow the matter to be dealt with quickly;
• ensure gathered evidence is kept confidential;
• inform the employee(s) of what disciplinary actions might be taken;
• indicate what authority each level of management has to take different disciplinary actions;
• inform the employee(s) of the complaints against them with supporting evidence;
• provide the employee(s) with an opportunity to appeal before a decision is made;
• allow the employee(s) to be accompanied (ie, human resources);
• assure no employee(s) will be dismissed for first offenses, except in the circumstance of gross misconduct;
• require a complete investigation is performed before disciplinary action is taken.
Scenario #4: Demonstrating Compliance With Regulatory or Legal Requirements
The need for regulatory or legal compliance can be business-centric depending on several factors, such as the industry the organization operates within (ie, financial), or the countries where business operations are conducted (ie, Unites States, India, Great Britain). Laws and regulations can also be enforced by different entities having different requirements for managing compliance and identifying noncompliance, such as:
• self-policed by a community (ie, “peer regulation”);
• unilaterally by those in power (ie, “fiat regulation”); or
• delegated to an independent third-party authority (ie, “statutory regulation”).
The importance of how these governing laws and regulations directly influence the way organizations operate must be clearly understood. Despite the grumblings of ensuring business operations follow the “red tape” of regulations, they are generally necessary to provide evidence of controls and show due care in circumstances where there is potential for negligence. While the types of regulations listed below may not be complete, it provides an understanding of the categories that can be applicable to organizations:
• Economic regulations are a form of government regulation that adjusts prices and conditions of the economy (ie, professional licenses to conduct business, telephony service fees)
• Social regulations are a form of government regulation that protects the interest of the public from economic activity such as health and the environment (ie, accidental release of chemical into air/water)
• Arbitrary regulations mandate the use of one out of several equally valid options (ie, driving on the left or right side of the road)
• Good faith regulations establish a baseline of behavior for a particular area (ie, restaurant health checks)
• Good conflict regulations recognize an inherent conflict between two goals and take control for the greater good (ie, wearing seat belts in vehicles)
• Process regulations dictates explicitly how tasks are to be completed (ie, call center scripts)
Scenario #5: Effectively Managing the Release of Court Ordered Data
No matter how diligent an organization, there are times when a dispute will end up before a court of law. When this happens, organization must be able to quickly produce credible evidence that supports their case and will not be called into question during legal proceedings.
For the most part, all organizations have common types of electronically stored information (ESI)
8 that are considered discoverable as digital evidence, such as e-mail messages. However, the likelihood that the courts will require discovery of different ESI will vary depending on the nature of the dispute or the business performed by the organization.
With adequate preparation, routine follow-ups, and a thorough understanding of what is considered reasonable in a court of law, organizations can effectively manage this risk. The most critical aspect of managing this risk to the court’s expectations is to be diligent with validating and verifying the integrity of ESI and avoid any interaction or activity that will be viewed as practicing bad faith.
9Discussed in chapter “
Evidence Management,” the Federal Rules of Evidence 803(6) describes that ESI is admissible as digital evidence in court if it demonstrates “records of regularly conducted activity” as a business record; such as an act, event, condition, opinion, or diagnosis. Ensuring compliance with this ruling requires organizations to implement a series of safeguards, precautions, and controls to ensure ESI is admissible in court and that it is authenticated to its original source.
Scenario #6: Supporting Contractual and/or Commercial Agreements
Depending on the nature of business performed, organizations can face disagreements that extend beyond disputes that commonly involve internal staff. Resulting in a various actions from breach of contract terms, improper termination of contracts, or large-scale class action lawsuits, these disputes can involve external entities such as business partners, competitors, shareholders, suppliers, or customers.
The majority of the interactions involved with contractual and commercial agreements can take place electronically. With these interactions being largely electronic, organization must ensure they capture and electronically preserve critical metadata about the agreements, such as details about the terms and conditions or the date the agreement was cosigned. Having this information available when needed can be extremely useful when it comes to preventing any type of loss (ie, financial, productivity, etc.) or when using arbitration as an alternative resolution path.
ESI needed to support contractual and commercial disputes may require detailed documentary evidence that thoroughly describes the relationship between the organization and the external entities. To ensure information regarding contractual and commercial agreements is accurately captured, a contract management system can be used to standardize and preserve on the metadata needed to provide sufficient grounds for supporting a dispute.
Scenario Assessment
Of the six digital forensic readiness scenarios discussed in this chapter not all of them might be relevant to every organization. Determining which scenarios are applicable requires that a thorough risk assessment of each scenario is completed.
Determination of whether any of these scenarios applies to an organization requires that both the qualitative and quantitative assessment, discussed further in
Appendix G: Risk Assessment, is performed to ensure that a thorough understanding of the potential risks is achieved. Following the completion of these assessments,
organizations will have a complete picture of all potential risks which can then be used to perform a cost-benefit analysis, discussed further in
Appendix E: Cost-Benefit Analysis, to determine the likely benefits of being able to use digital evidence.
Generally, if risks exists in a specific scenario and it has been identified that there is an ROI for digital forensic readiness, then the organization needs to consider what evidence sources need to be gathered.