1. The Need For Forensic Capabilities In The Commercial Sector
Dominique Brezinski
11/14/2018

2. Computer Forensics
Methodology and tool set for analyzing computer systems for evidence of compromise or misuse
Methods and tools must be defensible in a court of law
11/14/2018

3. Problem Space
Without the ability to tell when our digital assets have been compromised, we have an incomplete security solution at best
Forensic tools fill the gap between what computer security should be and what it is today
11/14/2018

4. Where we are today
Computer security solutions and architectures are incomplete
One and a half trillion dollars of loss due to computer crime in 1999 worldwide (PricewaterhouseCoopers)
Computer crime increasing in parallel with overall Internet growth
Current forensic tools support analysis of captured personal computers, not business computing environments
11/14/2018

5. How Did We Get Here?
Computer security solutions have not kept up with the risks associated with worldwide interconnectivity
High value digital assets that are easy to move and sell with a low risk profile (attractive to criminals)
Law enforcement has to transition to support Third Wave criminal investigation
11/14/2018

6. Still Getting There
Time consuming to do initial analysis to determine if system has been compromised
Law enforcement does not have the staff or expertise to investigate even a small percentage of computer crime
Currently a bit lawless, so we need to defend our own homesteads
11/14/2018

7. Available Options
Gap analysis—where do we need to be and where are the holes
We cannot effectively prevent computer crime with current technology
Need to be able to investigate and prosecute computer crime and recover losses (civil action)
11/14/2018

8. Recommendation
Develop accepted methodologies for investigating computer crime
Develop robust tools for system analysis and evidence collection to support investigations
Augment law enforcement by taking up slack
Pursue civil action (must support burden of proof)
11/14/2018