Actionable threat intelligence for digital forensics readiness. (11th February 2019)

• Record Type: Journal Article
• Authors: Serketzis, Nikolaos; Katos, Vasilios; Ilioudis, Christos; Baltatzis, Dimitrios; Pangalos, George J.
• Is Part Of: Information and computer security. Volume 27:Number 2(2019)
• Page Start: 273
• Page End: 291
• Publication Date: 2019-02-11
• Subjects: Information security -- Cybersecurity -- Cyber threat intelligence -- Digital forensic readiness -- Digital forensics -- Indicators of compromise; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-09-2018-0110
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: The purpose of this paper is to formulate a novel model for enhancing the effectiveness of existing digital forensic readiness (DFR) schemes by leveraging the capabilities of cyber threat information sharing. Design/methodology/approach: This paper uses a quantitative methodology to identify the most popular cyber threat intelligence (CTI) elements and introduces a lightweight approach to correlate those with potential forensic value, resulting in the quick and accurate triaging and identification of patterns of malicious activities. Findings: While threat intelligence exchange steadily becomes a common practice for the prevention or detection of security incidents, the proposed approach highlights its usefulness for the digital forensics (DF) domain. Originality/value: The proposed model can help organizations to improve their DFR posture, and thus minimize the time and cost of cybercrime incidents.