syssec_red_book

25.2. Research Themesconsists of setting up protocols and organizational structures for handlingthe incidents (who is in charge, who answers to whom, what role dovarious parties play, etc.)—all in the light of rules and regulations (such asthe general obligation to report information leaks). Another part will bethe assessment of such things like as: what was compromised, how badlywas it compromised, can the data manipulation be reverted, what needsmanual inspection, etc.? At the same time, it requires organizationalprocedures to deal with reviewing security protocols, disclosure to pressand public, assembling teams to deal with the recovery, etc.The goal of cyber forensics is to examine digital media in a sound mannerto identify, preserve, recover, analyze and present facts and opinionsabout the information. The first decision after an incident is an economicone. How essential is the compromised system? For example, in a criticalinfrastructure setting such as a power station, it may be more importantto get things up and running (without running the risk of a repeat) thanto gather forensic evidence. In a crime scene, however, highly skilleddigital forensics expertise is needed on-site as quickly as possible tocollect evidence in a way that will make it admissible in a court of law.This process requires deeply technical as well as legal knowledge. Liveforensics (forensics on a system that cannot be switched out, as in criticalsystems) and the attribution question (linking the criminal activity tothe criminals behind it) are examples of issues that urgently requireadditional research. The same is true for the legal side: what is admittedas what sort of evidence under what circumstances? Forensic evidencehas been used in a number of high profile cases and is becoming moreaccepted as reliable within US and European court systems. However,this is hampered by a lack of standards for digital forensic evidence,especially with multiple parties providing it. Again, research is neededinto developing such standards and methods.5. Data, Policy and Access ManagementIn the application domains the variety of data plays a key role. However,the confidentiality, availability, authenticity and integrity requirementsfor different kinds of data can vary greatly, both in the technical as well asin the legal sense. For example, health records must be kept for 70 years,and therefore require strong security, whereas other data are almostephemeral, such as the data by RFID tags. In this area, we need computerscience research to develop data management techniques (possibly oververy long time scales), but also organizational procedures, to ensurecorrect handling of sensitive data, and research to make sure that thetechnical policies match the user’s mental models and understanding.153