Hershey, Pennsylvania
New York, New YorkBeijing, China
A Socio-Technical Perspective on Threat Intelligence Informed Digital Forensic Readiness

A Socio-Technical Perspective on Threat Intelligence Informed Digital Forensic Readiness

Nikolaos Serketzis (Aristotle University of Thessaloniki, Thessaloniki, Greece), Vasilios Katos (Bournemouth University, Poole, UK), Christos Ilioudis (Alexander Technological Educational Institute of Thessaloniki, Thessaloniki, Greece), Dimitrios Baltatzis (International Hellenic University, Thessaloniki, Greece), and George J. Pangalos (Aristotle University of Thessaloniki, Thessaloniki, Greece)
Copyright: © 2020 |Pages: 12
DOI: 10.4018/978-1-7998-2466-4.ch070
OnDemand:
(Individual Chapters)
Available
$37.50
Current Special Offers
No Current Special Offers
TOTAL SAVINGS: $37.50

Abstract

In this article, a DFR framework is proposed focusing on the prioritization, triaging and selection of Indicators of Compromise (IoC) to be used when investigating of security incidents. A core component of the framework is the contextualization of the IoCs to the underlying organization, which can be achieved with the use of clustering and classification algorithms and a local IoC database.
Chapter Preview
Top

In a seminal paper, Hutchins et al. (Hutchins, Cloppert, & Amin, 2011) proposed an approach for studying and improving incident response against APTs. They introduced a cyber kill chain which identifies a path comprised of 7 discrete and sequential phases an attacker follows to meet their adversarial goals. From a digital forensics perspective, the kill chain is particularly helpful in highlighting the following:

  • •

    Every successful (to the attacker) phase is a direct consequence of the respective security control failures.

  • •

    Detecting the security breach early in the chain infers low impact and potential damage.

  • •

    Late detection of the security breach implies that there are more security failures. Hence the scope of the digital forensic artifact collection is wider.

For the remainder of this section, the relevant subtopics that will enable the key chain to leverage the proposed DFR framework are presented.

Complete Chapter List

Search this Book:
Reset