A Socio-Technical Perspective on Threat Intelligence Informed Digital Forensic Readiness

2. Related Works

In a seminal paper, Hutchins et al. (Hutchins, Cloppert, & Amin, 2011) proposed an approach for studying and improving incident response against APTs. They introduced a cyber kill chain which identifies a path comprised of 7 discrete and sequential phases an attacker follows to meet their adversarial goals. From a digital forensics perspective, the kill chain is particularly helpful in highlighting the following:

• •

  Every successful (to the attacker) phase is a direct consequence of the respective security control failures.

• •

  Detecting the security breach early in the chain infers low impact and potential damage.

• •

  Late detection of the security breach implies that there are more security failures. Hence the scope of the digital forensic artifact collection is wider.

For the remainder of this section, the relevant subtopics that will enable the key chain to leverage the proposed DFR framework are presented.