Performing an APT Investigation: Using People-Process-Technology-Strategy Model in Digital Triage Forensics
| Title | Performing an APT Investigation: Using People-Process-Technology-Strategy Model in Digital Triage Forensics |
| Publication Type | Conference Paper |
| Year of Publication | 2015 |
| Authors | Kao, D. Y. |
| Conference Name | 2015 IEEE 39th Annual Computer Software and Applications Conference |
| Date Published | July 2015 |
| Publisher | IEEE |
| ISBN Number | 978-1-4673-6564-2 |
| Keywords | advanced persistent threat, APT, auditing logs, Computer crime, Computers, cyber security incident, cyberattacks, cybercrime investigation, cyberspace battle, digital data, digital evidence, digital forensic practitioner, digital forensics, digital triage forensics, evidence dynamics identification, golden triangle components, Nonvolatile memory, people-process-technology-strategy model, Plugs, PPTS model, pubcrawl170109, Random access memory |
| Abstract | Taiwan has become the frontline in an emerging cyberspace battle. Cyberattacks from different countries are constantly reported during past decades. The incident of Advanced Persistent Threat (APT) is analyzed from the golden triangle components (people, process and technology) to ensure the application of digital forensics. This study presents a novel People-Process-Technology-Strategy (PPTS) model by implementing a triage investigative step to identify evidence dynamics in digital data and essential information in auditing logs. The result of this study is expected to improve APT investigation. The investigation scenario of this proposed methodology is illustrated by applying to some APT incidents in Taiwan. |
| URL | https://ieeexplore.ieee.org/document/7273322 |
| DOI | 10.1109/COMPSAC.2015.10 |
| Citation Key | kao_performing_2015 |
- digital forensic practitioner
- Random access memory
- pubcrawl170109
- PPTS model
- Plugs
- people-process-technology-strategy model
- Nonvolatile memory
- golden triangle components
- evidence dynamics identification
- digital triage forensics
- Digital Forensics
- advanced persistent threat
- digital evidence
- digital data
- cyberspace battle
- cybercrime investigation
- cyberattacks
- cyber security incident
- Computers
- Computer crime
- auditing logs
- APT