2014 Eighth International Conference on IT Security Incident Management & IT Forensics最新文献

Post-Mortem Memory Analysis of Cold-Booted Android Devices 冷启动Android设备的事后内存分析

2014 Eighth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2014-05-12 DOI: 10.1109/IMF.2014.8

Christian Hilgers, Holger Macht, Tilo Müller, Michael Spreitzenbarth

引用次数: 36

Information Security Incident Management: Planning for Failure 信息安全事件管理:失败计划

2014 Eighth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2014-05-12 DOI: 10.1109/IMF.2014.10

M. B. Line, Inger Anne Tøndel, M. Jaatun

{"title":"Information Security Incident Management: Planning for Failure","authors":"M. B. Line, Inger Anne Tøndel, M. Jaatun","doi":"10.1109/IMF.2014.10","DOIUrl":"https://doi.org/10.1109/IMF.2014.10","url":null,"abstract":"This paper reports on an interview study on information security incident management that has been conducted in organizations operating industrial control systems that are highly dependent on conventional IT systems. Six distribution service operators from the power industry have participated in the study. We have investigated current practice regarding planning and preparation activities for incident management, and identified similarities and differences between the two traditions of conventional IT systems and industrial control systems. The findings show that there are differences between the IT and ICS disciplines in how they perceive an information security incident and how they plan and prepare for responding to such. The completeness of documented plans and procedures for incident management varies. Where documentation exists, this is in general not well-established throughout the organization. Training exercises with specific focus on information security are rarely performed. There is a need to create amore unified approach to information security incident management in order for the power industry to be sufficiently prepared to meet the challenges posed by Smart Grids in the near future.","PeriodicalId":419890,"journal":{"name":"2014 Eighth International Conference on IT Security Incident Management & IT Forensics","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121466913","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 23

The Humming Hum: Background Noise as a Carrier of ENF Artifacts in Mobile Device Audio Recordings 嗡嗡声:背景噪声作为移动设备录音中ENF伪影的载体

2014 Eighth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2014-05-12 DOI: 10.1109/IMF.2014.14

Niklas Fechner, Matthias Kirchner

引用次数: 33

AFAUC -- Anti-forensics of Storage Devices by Alternative Use of Communication Channels AFAUC—通过替代使用通信渠道对存储设备进行反取证

2014 Eighth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2014-05-12 DOI: 10.1109/IMF.2014.11

Harald Baier, J. Knauer

{"title":"AFAUC -- Anti-forensics of Storage Devices by Alternative Use of Communication Channels","authors":"Harald Baier, J. Knauer","doi":"10.1109/IMF.2014.11","DOIUrl":"https://doi.org/10.1109/IMF.2014.11","url":null,"abstract":"Since the end of the 1990ies side channel attacks became a very prominent branch of cryptography. In other areas of computer security, however, side channels are not well studied. It is the primary goal of this paper to raise the awareness of the community about the potential existence of side channels during a forensic investigation. We present a concept called AFAUC - anti-forensics of data storage by alternative use of communication channels. The general idea is to confuse the investigator by abusing a communication channel for unintended purposes. As a concrete example of AFAUC, we access a storage device through its diagnostic interface to obfuscate data on that device. More precisely, we analyse if it is feasible in practice to abuse an existing communication channel, which was designed for a different purpose, to hide data in an area of a hard disc drive (HDD), which is not accessible by an investigator and which is different from the well-known Host Protected Area and Device Configuration Overlay, respectively. The basic idea is to access the HDD via its diagnostic interface in an unintended manner and to manipulate its size in the firmware setting. We show that this is possible even without any expensive tool for a Samsung HDD. Evaluation including a test in a law enforcement laboratory revealed that the hidden data would not be detected in an ordinary case. Hence AFAUC may be used by skilled, but not well-funded users. Although AFAUC is a classical dual-use technology, we would like to initiate the community to come up with further alternative use cases of communication channels to support users in oppressive countries to defend themselves. In contrast to the underground economy these users are typically not well-funded and thus depend on reliable anti-forensic methods.","PeriodicalId":419890,"journal":{"name":"2014 Eighth International Conference on IT Security Incident Management & IT Forensics","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-05-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131574790","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Information Security Incident Management: Identified Practice in Large Organizations 信息安全事件管理:大型组织中的识别实践

2014 Eighth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2014-05-12 DOI: 10.1109/IMF.2014.9

C. Hove, M. Tarnes, M. B. Line, K. Bernsmed

引用次数: 40

Assuming a State of Compromise: A Best Practise Approach for SMEs on Incident Response Management 假设妥协状态:中小企业事件响应管理的最佳实践方法

2014 Eighth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2014-05-12 DOI: 10.1109/IMF.2014.13

Alexander Harsch, S. Idler, S. Thurner

引用次数: 6

A Hierarchical Model for the Description of Internet-Based Communication 基于互联网的通信描述的层次模型

2014 Eighth International Conference on IT Security Incident Management & IT Forensics Pub Date : 2014-05-12 DOI: 10.1109/IMF.2014.12

R. Altschaffel, J. Dittmann, Christian Krätzer, Stefan Kiltz

引用次数: 1