Digital Forensic Evidence - The missing link in Threat Modeling
Authors:
- 26 October 2020
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- p. 1-5
Abstract
Threat modeling is a set of methodologies to analyze the potential threats in a digital system, in order to mitigate them. Digital forensics, on the other hand, is used in order to find the true origin of an event with the help of forensic evidence. Digital forensics is based on Locard’s Principle and dictates that even digital crime leaves behind some form of remnants. Both the domains, threat modeling and digital forensics, have separately existed, but have to our knowledge not been used together. In this research we establish the importance of forensic evidence and how it can aid threat modeling by providing more comprehensive threat intelligence. We provide practical examples of how the two fields can be combined, based on attack graphs and Bayesian networks.Keywords
This publication has 12 references indexed in Scilit:
- Enhancing Honeypot Deception Capability Through Network Service FingerprintingJournal of Physics: Conference Series, 2017
- pwnPr3d: An Attack-Graph-Driven Probabilistic Threat-Modeling Approach2016
- An extensible pattern-based library and taxonomy of security threats for distributed systemsComputer Standards & Interfaces, 2014
- Automating Risk Analysis of Software Design ModelsThe Scientific World Journal, 2014
- Threat‐oriented security framework in risk management using multiagent systemSoftware: Practice and Experience, 2012
- A threat model‐based approach to security testingSoftware: Practice and Experience, 2012
- Foundations of Attack–Defense Trees2011
- Training and Education in Digital Evidence2007
- Foundations of Attack Trees2006
- Automated generation and analysis of attack graphs2005