SecLaaS

How can organisations be forensically ready? As organisations are bound to be criticised in the digitally developing world, they must ensure that they are forensically ready. The readiness of digital forensics ensures compliance in an organisation’s legal, regulatory, and operational structure. Several digital forensic investigative methods and duties are based on specific technological designs. The present study is the first to address the core principles of digital forensic studies, namely, reconnaissance, reliability, and relevance. It reassesses the investigative duties and establishes eight separate positions and their obligations in a digital forensics’ investigation. A systematic literature review revealed a gap in the form of a missing comprehensive direction for establishing a digital forensic framework for ethical purposes. Digital forensic readiness refers to the ability of a business to collect and respond to digital evidence related to security incidents at low levels of cost and interruption to existing business operations. This study established a digital forensic framework through a systematic literature review to ensure that organisations are forensically ready to conduct an efficient forensic investigation and to cover ethical aspects. Furthermore, this study conducted a focus group evaluation through focus group discussions to provide insights into the framework. Lastly, a roadmap was provided for integrating the system seamlessly into zero-knowledge data collection technologies.

Background: The rise of digital technology has transformed how children engage with the world but has also exposed them to online exploitation. Crimes such as child sexual abuse material (CSAM), grooming, cyberbullying, and trafficking have increased, making digital forensics essential in child protection. This presentation examines how forensic medicine and digital forensics aid in identifying, investigating, and preventing these crimes. The research objectives examine the roles of forensic medicine and digital forensics in identifying, investigating, and preventing online child exploitation, and highlight emerging forensic technologies and multidisciplinary approaches to enhance child safety. Method: A comprehensive literature review was conducted using PubMed, Web of Science, and Google Scholar, focusing on publications from 2015 to 2024. Search terms included "digital forensics," "child sexual abuse," "cyberbullying," "AI in forensic investigations," and "forensic medicine in child protection". Studies were included if they addressed forensic methods for detecting, investigating, or preventing online child exploitation. Results: Experts in digital forensics use cutting-edge technologies like blockchain analysis to track illegal financial transactions, automated Al-based systems for identifying and classifying exploitative content, dark web investigations to track encrypted communications, and metadata analysis to reveal hidden information in digital files. Contributions from forensic medicine specialists include assisting with victim identification, recording physical and psychological evidence of abuse, and working with digital forensic teams to conduct thorough case evaluations. The effectiveness of prevention and intervention initiatives is increased when forensic experts, law enforcement, and child protection organizations work together interdisciplinary. Conclusion: Strengthening digital forensic capabilities and promoting child-centered ethical practices are essential to minimize and prevent the growing threat of online child exploitation. Ongoing research, innovation, and policy development will be crucial to safeguarding the rights and wellbeing of children in the era of digital technology.

Cloud computing provides to the consumers basic computing resources that range from storage and computing power to sophisticated applications. When digital forensics is needed for suspected cases involving cloud computing, the provider is responsible for collecting the digital evidence. Limitations of this approach include lack of efficient incident response, and that the consumers may have a little or no choice but to accept electronic evidences made available by the cloud provider. This research investigates whether it is possible to perform consumer-side digital forensics where a consumer independently collects all digital evidences required for a suspected case from Infrastructure as a Service resources (IaaS). In particular, the research contributes to a digital forensics readiness framework that shows how digital evidence collection can be made strongly consumer-centric, so that all the electronic evidences that digital forensic investigation requires for suspected cases can be provided independently by the IaaS consumers.

Due to the unprecedentedly ubiquitous wireless computer networks and mobile devices become prevalent, more unscrupulous technology hacktivists commit illegal conspiracies towards innocent victims via the ever growing Internet technology. Indeed, cybercrimes are relentlessly reported worldwide. The law enforcement agencies have the indispensable responsibility to crack the well-funded crime syndicate in our computer society. Consequently, Digital Forensics (DF) emerges and becomes the critical success factor to prosecute the culprit and prevent the associate cybercrime incidents from occurring. In the meanwhile, the computer society has an urgent demand for competent DF professionals to gather convincing digital evidences to assist indicting heinous perpetrators in order to allay the fears of everlasting computer crimes events in both private and public sectors. The research provides a vivid roadmap and suggested core curriculum design guidelines for higher education institutions to be integrated into their existing similar program or adopting as a groundbreaking reference model. A serial, cross-discipline, and functional approach were combined in order to design the suggested curriculum. Furthermore, the paper is attempting to minimize the theorypractice gap in DF and provide a milestone for higher education institutions to contemplate if necessary.

Digital Forensics has become an indispensable tool in contemporary cybercrime investigations, which ensures systematic identification, collection, preservation, and presentation of electronic evidence in a legally admissible manner. As cybercrimes continue to escalate, investigative authorities are required to operate across multiple digital domains, including personal devices, mobile platforms, cloud infrastructures, and transnational communication networks, with strict adherence to the law. Digital forensics is important not only because it can recover the deleted or concealed data, but also because it ensures that the evidence remains authentic and untouched throughout the investigation. Due to its dual emphasis on both technology and law, it effectively bridges the gap between technical accuracy and legal accountability. Despite being so advanced in the contemporary world, the field of digital forensics still faces persistent challenges. The extensive reliance on data encryption, rapid technological innovations, and the issue of complex jurisdiction in cross-border investigations complicate and hamper the effective use of digital forensics. Moreover, the escalation of data generated in the digital age raises concerns about privacy, transparency, and the timely administration of justice. Addressing these concerns requires some advanced and well-developed standardized forensic frameworks, legal protocols, and greater international cooperation to harmonize investigative procedures. This paper shall dwell upon the continuous evolution of the role of digital forensics in cybercrimes in the contemporary world. It shall particular ly focus on the foundations, challenges, evidentiary value, and implications for law enforcement and global cybersecurity. It shall also emphasize the strengthening of digital forensics so that harmonious international relations and global cybersecurity can be achieved.

Until today, Cloud providers only offer a limited set of non-negotiable service levels to their customers. Most often these service levels are expressed as guarantees for availability together with the offer to have access to a virtualised environment with a certain performance the customer may select from a number of predefined configurations. This simplifies the life of the provider, e.g., in terms of effort to maintain an adequate infrastructure, or regarding the effort for reducing the risk violating Service Level Agreements (SLAs) with its customer. In consequence, the current practice is slanted towards the benefit of the provider and ignores more specific requirements of its customers, e.g. regarding data protection and related guarantees. An analysis of the underlying problems shows two major fields to be worked on for solving the problem: Firstly, each provider uses its own proprietary technology for managing SLAs throughout their life-cycles. However, first standards are available and could be employed allowing the customer to use a single standard interface to negotiate with several providers. Secondly, there is neither a common set of terms to describe Cloud customers requirements regarding the Cloud services requested, nor, the back side of the medal, there is a common set of terms to describe the Quality of Service (QoS) of the Cloud providers' offerings. The focus of the presented work is (i) on the standard technology for negotiating and creating SLAs and (ii) the common terms and metrics describing providers' offerings and customers' requirements. Without these terms mapping the customers' requirements to cloud providers' offerings is a tedious manual and error-prone process and resulting SLAs will remain rudimentary. Additionally, both providers and their customers would benefit from more sophisticated and negotiable Service Level Agreements using existing standards. These SLAs are both (i) binding and monitorable agreements between the customer and the provider covering the customers' requirements and (ii) the basis for a QoS-aware Cloud resource management on the side of the provider including provisioning of physical machines and optimised allocation of virtual machines. Besides more traditional QoS aspects, terms related to Cloud Federation, Data Protection or Security Level Agreements are covered. Customers may use standards compliant agreement templates with the providers' offerings to select suitable providers for starting the negotiation to the extent the provider allows in the template. During the negotiation the provider may take into account the actual degree of capacity utilisation of its infrastructure and active SLAs, and may use the SLA resulting from a successful negotiation to further optimise its infrastructure through application and VM consolidation. The work presented in this thesis covers about a decade of research starting in the environment of Grid computing and ending with today's Cloud computing.

Network forensics is the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents. Network forensics is a sub-branch of digital forensics. Network device forensics is also a sub-branch of network digital forensics. Forensic IT applications and examination of suspicious users` personal computers to be copied to all of the data alone is not sufficient for the determination of guilt or innocence. Users before the event and during the event is logged on the network traffic to be carried out is important. These records are necessary to preserve the security measures on the network devices, the devices required by the user on the network can not use, the internet user`s IP address and MAC address of the output to be significant, the user attempts to disrupt the functioning of the network is very important in minimizing. Users, network devices must not interfere with the records. In this study, as well as to facilitate network forensics investigations on network devices to improve network security configuration settings to be discussed.

Today, centralized data-centers or clouds have become the de-facto platform for data-intensive computing in the commercial, and increasingly, scientific domains. This is because clouds such as Amazon AWS and Microsoft Azure offer large amounts of monetized co-located computation and storage well suited to typical processing tasks such as batch analytics. However, many Big Data applications rely on data that is geographically distributed, and is not collocated with the centralized computational resources provided by clouds. Examples of such applications include analysis of user data such as blogs, video feeds taken from geographically separated cameras, monitoring and log analysis of server and content distribution network (CDN) logs, and scientific data collected from distributed instruments and sensors. Such applications lead to a number of challenges for efficient data analytics in today's cloud platforms. First, in many applications, data is both large and widely distributed and data upload may constitute a non-trivial portion of the execution time. Second, centralized cloud resources present a single point of failure and network partitions between the data sources and the cloud can also lead to service disruptions. Third, the cost to transport, store, and process data may be outside of the budget of the small-scale application designer or end-user. The paper present Nebula: a dispersed edge cloud infrastructure that provides both computation and data storage to address the above challenges. The use of edge resources is attractive for several reasons. First, there is an increasing amount of computing and storage resources available on the edge, as evidenced by their use in several volunteer computing, filesharing as well as content delivery (CDN) environments. This capacity is likely to increase further with the provision of powerful multi-core, multi-node desktop and home machines coupled with increasing amount of high bandwidth Internet connectivity. Second, edge resources provide locality to data and users naturally, and hence, can be exploited easily for insitu processing. Finally, if cost is an issue, then volunteer edge resources can be utilized at a relatively low cost.

Cloud Computing has become in just few years a key consideration for businesses and governments willing to externalize their infrastructure, increase flexibility and reduce the cost of their infrastructure (CAPEX), maintenance and operation (OPEX). Although several commercial solutions are available, there are still numerous issues to solve. Two important aspects to address are the lock-in risk with one Cloud Provider (CP) and the fulfillment of the contractual SLA (Service Level Agreement). In this paper, we propose an integrated approach based on the concept of Broker that takes benefit from different CPs to efficiently embed a complex service into the various available cloud infrastructures. The Broker approach allows Cloud Customer (CC) to be independent from any particular CP while taking benefit from the overall available resources and avoid the lock-in with a particular one. In addition, we leverage the service model to provide Customers with the possibility to request different types of services (e.g. compound service) and propose a solution to fulfill requested Customer SLA in terms of availability, cost and geographic location according to the contracted SLA between the Broker and the CPs. We have implemented the solution in a lab cloud infrastructure and performed several tests and simulations to highlight the benefit of our approach.

In present modern times when operating systems require larger amounts of RAM or Random Access Memory, we usually come across computers with 4 GB RAM, but given the price drops, it is quite usual to come across computers with 64 GB of RAM as well. By imaging this part of computer memory and by performing forensics analysis of the data located in RAM, it can be easily concluded that performing RAM imagining and analysis should be one of the essential steps in any forensic investigation. This paper will give a short introduction to digital forensics and the role of live data forensics. Furthermore, the mail goal will be to show and explain the importance of forensics of live machines and artefacts which can be found as well as methods and tools which are used for extracting and analyzing data from RAM. In addition, it will be shown that sometimes in forensic investigations, data contained in RAM can contain enough evidence to solve the whole case and actually be everything a digital forensics investigator really need.

An algorithm for network and data-aware placement of multi-tier applications in cloud data centers

Most organizations underestimate the demand for digital evidence [1]. Often, when evidence is required to prove fraudulent transactions, not enough or trustworthy evidence is available to link the attacker to the incident. It is essential for organizations to prepare themselves for digital Forensic (DF) investigations and ensure that entire organizational operating environment is prepared for example for an investigation (criminal or internal) or acompliance tests. The accepted literature on DF readiness concentrates mainly on evidence identification, handling and storage, first line incident response and training requirements [2]. It does not consider the proactive application of DF tools to enhance the corporate governance structures (specifically Information Technology (IT) governance). Pro-active DF (ProDF) as defined in this paper will enable an organization to take the initiative by implementing adequate measures to become DF ready,demonstrate due diligence for good corporate Governance, specifically IT Governance and provide a mechanism to assess and improve IT Governance frameworks. The purpose of this paper is to define, identify goals, steps, and deliverables of ProDF, identify dimensions of DF, and propose a theoretical DF management framework to guidethe implementation of ProDF in an organization.

Digital forensics is the digital equivalence of traditional crime investigations that leverages digital technologies to facilitate criminal investigations. The expertise and previous experience of an investigator or any security agent in traditional forensic investigations play an important role in the success, efficiency, and effectiveness of the investigation. Similarly employing the power of intelligence in the current computational resources in the digital investigation process will lead to more efficient and effective digital investigation results. This study builds on existing works in the literature to propose the use of clustering and classification machine learning algorithms on evolving database files to achieve intelligence in the digital investigation process and finally come up with a comprehensive block diagram as a general-purpose framework for intelligent forensic investigation.

While static examination of computer systems is an important part of many digital forensics investigations, there are often important system properties present only in volatile memory that cannot be effectively recovered using static analysis techniques, such as offline hard disk acquisition and analysis. An alternative approach, involving the live analysis of target systems to uncover this volatile data, presents significant risks and challenges to forensic investigators as observation techniques are generally intrusive and can affect the system being observed. This paper provides a discussion of live digital forensics analysis through virtual introspection and presents a suite of virtual introspection tools developed for Xen (VIX tools). The VIX tools suite can be used for unobtrusive digital forensic examination of volatile system data in virtual machines, and addresses a key research area identified in the virtualization in digital forensics research agenda [22].

A Survey on SDN Orchestration and NFV in Cloud Networking