Title: Intelligence-led response: turning theory into law enforcement practice in cyber security incidents

Authors: Da-Yu Kao; Shou-Ching Hsiao; Raylin Tso

Addresses: Department of Information Management, Central Police University, Taoyuan, Taiwan ' Haishan Precinct, New Taipei City Police Department, New Taipei City, Taiwan ' Department of Computer Science, National Chengchi University, Taipei, Taiwan

Abstract: As the internet grows drastically in scale and density, the number of cyber security incidents investigated by law enforcement agencies (LEAs) is skyrocketing. Criminals may deny committing a crime, but LEAs are hindered in proving it by the limited processing capabilities of human analysis. While initial crime scene investigation emphasises finding actionable intelligence as quickly as possible, lab forensics focuses on reconstructing the case and cross-referencing the evidence to find the truth. Both are critical parts of the investigative response to cyber security incidents. This paper presents a practical digital forensic framework based on ISO/IEC 27043: 2015 activities, intended to handle digital evidence at the crime scene and lessen the caseload burden at the lab. By advocating an intelligence-led response to crime scene investigation and lab forensics, we aim to turn theory into practice for LEAs, supporting the resolution of cyber security incidents and the understanding of what happened. By working through the different processes and activities in practical exercises, we aim to enable LEAs to implement a response strategy for combating cyber crime.

Keywords: digital forensics; ISO/IEC 27043: 2015; intelligence-led response; cyber security; law enforcement.

DOI: 10.1504/IJEB.2020.111058

International Journal of Electronic Business, 2020 Vol.15 No.4, pp.325 - 350

Received: 16 May 2018
Accepted: 18 Jul 2018
Published online: 09 Nov 2020 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article