SDD: TRIM, GC and Greedy Garbage etc
It is amazing how we can all look at the same subject but still have a wide range of views. If the discussion is about TRIM and GC then the two should not be confused. That is fair warning, but isn't there something quite obvious in the two different titles? If we extend confusion further what Write Amplification or hot and cold data or SSDs with no TRIM feature at all? The diversity in opinions may well be put down to has:
(a) conducted tests and
(b) which tests were they
(c) any standard involved
(d) any manufacturer spec involved and
(e) any research material read influencing the thought processes?
Who knows the answers as many of the discussions read rarely identify the sources of knowledge.
I cannot guarantee you that this thread will provide all the answers but here are some sources of information that may help. Perhaps you can contribute, too? The materials are not arranged in any particular order.
why-ssd-destroy-court-evidence - http://belkasoft.com/download/info/SSD%20Forensics%202012.pdf
ssd-2014 - http://belkasoft.com/download/info/SSD%20Forensics%202014.pdf
Mac OSx enabling TRIM - http://arstechnica.com/apple/2015/06/latest-os-x-update-allows-you-to-enable-trim-for-third-party-ssds/
Kingston on Garbage Collection - http://media.kingston.com/images/ssd/technicalbrief/MKF_608_%20SSDGarbagecollectionTechBrief.pdf
On the Optimality of Greedy Garbage Collection for SSDs - https://www.dropbox.com/s/62743amgz9yu9nd/YYang.pdf?dl=0
Write Amplification - https://www.dropbox.com/s/ty0e4hs9aou5mux/WriteAmplification.pdf?dl=0
A Mean Field Model for a Class of Garbage Collection
Algorithms in Flash-based Solid State Drives - https://www.dropbox.com/s/xailw5tb702dsfe/VanHoudt_QUESTA.pdf?dl=0
Establishing Professional Guidelines for SSD Forensics: A Case Study - https://www.dropbox.com/s/y1eqlqhtd7q0e69/UchiyamaJJ.pdf?dl=0
Model and Analysis of Trim Commands in Solid State Drives - https://www.dropbox.com/s/z7b5u7s0flvywa8/TRIM%20eScholarship%20UC%20item%208gn63800.pdf?dl=0
To TRIM or Not to TRIM: Judicious TRIMing for Solid State Drives - https://www.dropbox.com/s/nfce2k3h3j2jc89/sosp11-final16.pdf?dl=0
DELL Solid State Drive (SSD) FAQ - https://www.dropbox.com/s/tushqjeow02ds0n/Solid-State-Drive-FAQ-us.pdf?dl=0
SATA-IO Releases Revision 3.1 Specification - https://www.dropbox.com/s/5buxd4qtvnhpfvu/SATA-IORevision31_PRfinal.pdf?dl=0
The Fundamental Limit of Flash Random Write Performance: Understanding, Analysis and Performance Modelling - https://www.dropbox.com/s/me322d1e4xoz2md/rz3771.pdf?dl=0
Performance of garbage collection algorithms for flash-based solid state drives with hot/cold data - https://www.dropbox.com/s/8a66duhnc2b5w09/hot_cold.pdf?dl=0
Extending the Lifetime of Flash-based Storage through Reducing Write Amplification from File Systems - https://www.dropbox.com/s/c7vdp3011icue68/fast13-final110.pdf?dl=0
Data Set Management Commands Proposal for ATA8-ACS2 2007 - https://www.dropbox.com/s/vkm0er1804swk2z/e07154r6-Data_Set_Management_Proposal_for_ATA-ACS2.pdf?dl=0
Information technology -ATA/ATAPI Command Set - 2 (ACS-2) 2009 - https://www.dropbox.com/s/6tm8pbu41tefcm3/d2015r1-ATAATAPI_Command_Set_-_2_ACS-2.pdf?dl=0
Information technology -ATA/ATAPI Command Set - 2 (ACS-2) 2011 - https://www.dropbox.com/s/l4onbxkeeuqa4is/d2015r6-ATAATAPI_Command_Set_-_2_ACS-2.pdf?dl=0
Modelling and Managing SSD Write-amplification - https://www.dropbox.com/s/r59p76n5oa7nzhe/1504.00229.pdf?dl=0
Sunday, December 27, 2015
Sunday, December 20, 2015
Updated: Employment or Computer Forensics Course 2016
There are many people who would like to go into computer forensics that maybe are working elsewhere, currently studying an associated or indirect subject or generally have an interest to find out more. The prospect of employment is naturally the primary objective.
EMPLOYMENT
There are many ways to objectify and define a career path. Some look at the academic route first, some the employment route and others take measured assessments to determine the best path forward. It is whatever suits you best because work in civilian careers is different when working with a public sector agency.
1) Interested in working in the public sector - seek out the agency that is of interest to you and find their careers webpage. Now visit other agencies and see if there is a common theme of interest e.g. computer and smartphone forensics, digital investigations etc.
2) Are the qualifications or experience you need for the vacancy and any training offered?
3) Write to an agency to ask for their public statement on recruiting civilian employees in computer forensics?
4) Ask for the link to their public webpage that describes the equal opportunities the public sector agency is lawfully bound to publicise.
What if the private sector is more appealing to you. The above should still stand you in good stead.
EMPLOYMENT ADVERTISEMENT
Be smart and understand employment advertisements that are simply asking too much e.g. the applicant should be Einstein, know everything, but work for a pittance. These adverts do more harm than good. Apply a litmus test - (a) what is the time period of experience the person would need to qualify for each subject and then (b) how old does the person need to be.
An example of an employment advertisement seen recently, we looked at the Job description compared with the experience the person would need for each of the subject matters set out in the job description.
A test criteria was identified as to what knowledge skill and experience the applicant would need:
a) read a book,
b) 6mths,
c) 2yrs,
d) 5yrs,
e) 10yrs
Computer Science/Criminal Justice: ........ -v- ..........Time period of experience
- Teach undergraduate and graduate courses..........read a book, 6mths, 2yrs, 5yrs, 10yrs
- basic and advanced digital forensics and cyber security...read a book, 6mths, 2yrs, 5yrs 10yrs
- Knowledge of digital evidence and analysis..........read a book, 6mths, 2yrs, 5yrs, 10yrs
- network forensics...................read a book, 6mths, 2yrs, 5yrs, 10yrs
- EnCase....read a book, 6mths, 2yrs, 5yrs, 10yrs
- risk management...read a book, 6mths, 2yrs, 5yrs, 10yrs
- information security...read a book, 6mths, 2yrs, 5yrs, 10yrs
- information assurance compliance.....read a book, 6mths, 2yrs, 5yrs 10yrs
- network defense...read a book, 6mths, 2yrs, 5yrs, 10yrs
- incident response.....read a book, 6mths, 2yrs, 5yrs, 10yrs
- vulnerability assessment......read a book, 6mths, 2yrs, 5yrs, 10yrs
Given the title of the knowledge, skills and experience sought in the job description realistically a candidate would need to have had maybe between 3yrs-5yrs on each subject. This suggests between 33 to 55 years exposure to dealing with those subjects. So a candidate having started out learning at 20 years of age should be between the age of 53 to 75 to apply for the vacancy?
Alternatively, if only three subjects were the primary requirement then possibly 10 years of knowledge skill and experience might be necessary and the other subjects might be covered by reading a book on each subject.
EMPLOYMENT AGENCIES
There are many good employment agencies out there who are sensible and reasonable and define to their clients that given the sum of money they want to pay for the vacancy there needs to be incentives defined for extra knowledge, skills and experience being brought in-house that the company sells as a service to customers as value-added services. And that is a key-point for potential recruits - what VALUE-ADDED knowledge, skills and experience could you offer above the job description. Never, ever agree to provide every bit knowledge, skills and experience defined in an advertisement.
FIND OUT ABOUT EMPLOYER JOB ADVERTS
Absolute goal for research and during interviews:
i) Know the company you want to work for?
ii) Know who are their major competitors?
iii) Seek out the companies market share?
iv) Know whether you can assist maintain their current share or improve on it (e.g. Value Added)?
v) What is the financial status of the company?
vi) Whilst potential employers want to know your life story you equally have the right to know their story, too?
vii) Don't turn down a good job for one thought to be better, only to find out the latter company is using short term government grants to get people off unemployment. Check what is meant by probationary period.
UNIVERSITIES
I have updated, as of today (20/12/2015), a list of Universities in England, Wales, Scotland and Ireland offering computer forensic courses for 2016 that are stand alone or incorporated with another subject matter.
These are useful website to find out about the educational qualifications available for computer forensics and related subjects. I haven't hinted my suggestions about the courses because some fundamental requirements of any forensics discipline is that a person's learns how to:
(1) source information
(2) thoroughly research
(3) identify salient details and facts
University of Bedfordshire
http://www.beds.ac.uk/howtoapply/courses/undergraduate/current-year/computer-security-and-forensics
Birmingham City University
http://www.bcu.ac.uk/courses/forensic-computing
Canterbury Christ Church University
http://www.canterbury.ac.uk/study-here/courses/undergraduate/computer-forensics-and-security.aspx
Cranfield University
http://www.cranfield.ac.uk/courses/masters/forensic-computing.html
De Montfort University
http://www.dmu.ac.uk/study/courses/undergraduate-courses/forensic-computing.aspx
University of Derby
http://www.derby.ac.uk/courses/computer-networks-security-bsc-hons/
http://www.derby.ac.uk/courses/computer-forensics-bsc-hons/
University of Gloucestershire
http://www.glos.ac.uk/courses/descriptors/pages/ct5020-foundations-of-forensic-tools-and-techniques.aspx
http://www.glos.ac.uk/courses/descriptors/pages/ct5021-network-design-security-forensics.aspx
http://www.glos.ac.uk/courses/descriptors/pages/ct5024-cryptography-and-forensics.aspx
University of Greenwich
http://search.gre.ac.uk/s/search.html?collection=website-meta&form=simple-15&profile=_default&query=computer+forensics
University of Central Lancashire
http://www.uclan.ac.uk/courses/bsc_forensic_computing_foundation_entry.php
http://www.uclan.ac.uk/courses/bsc_hons_forensic_computing.php
Leeds Metropolitan University
http://courses.leedsbeckett.ac.uk/computerforensics
http://courses.leedsbeckett.ac.uk/computerforensicssecurity
http://courses.leedsbeckett.ac.uk/digitalforensics_security_msc
Liverpool John Moores University
https://www.ljmu.ac.uk/study/courses/undergraduates/2016/computer-forensics-with-foundation-year-bsc
https://www.ljmu.ac.uk/study/courses/undergraduates/2016/computer-forensics-mcomp
https://www.ljmu.ac.uk/study/courses/undergraduates/2016/computer-forensics
https://www.ljmu.ac.uk/study/courses/postgraduates/computer-forensics
University of East London
http://www.uel.ac.uk/postgraduate/specs/iscf/
London Metropolitan University
http://www.londonmet.ac.uk/courses/undergraduate/2016/computer-forensics-and-it-security---bsc-hons/
University of London - Royal Holloway
https://www.royalholloway.ac.uk/isg/prospectivestudents/prospectivestudents-msc/home.aspx
Manchester Metropolitan University
http://www2.mmu.ac.uk/study/undergraduate/courses/2016/13055/
Middlesex University
http://www.mdx.ac.uk/courses/undergraduate/computer-forensics
Northumbria University
https://www.northumbria.ac.uk/study-at-northumbria/courses/computer-and-digital-forensics-mcomp-uuscdi1/
The Open University
http://www.open.ac.uk/postgraduate/modules/m812
http://www.open.edu/openlearn/science-maths-technology/computing-and-ict/introduction-computer-forensics-and-investigations/content-section-0
University of Portsmouth
http://www.port.ac.uk/courses/computing-and-creative-technologies/bsc-hons-forensic-computing/
Sheffield Hallam University
http://www.shu.ac.uk/prospectus/course/1097/
Staffordshire University
http://www.staffs.ac.uk/course/SSTK-11000.jsp
University of Sunderland
http://www.sunderland.ac.uk/courses/appliedsciences/undergraduate/computer-forensics/
Teesside University
http://www.tees.ac.uk/prospectus/ug/UG_course.cfm?courseid=121&fos=8&fossub=22
http://www.tees.ac.uk/prospectus/ug/UG_course.cfm?courseid=1797&fos=8&fossub=164
http://www.tees.ac.uk/prospectus/ug/UG_course.cfm?courseid=1311&fos=8&fossub=22
http://www.tees.ac.uk/prospectus/ug/UG_course.cfm?courseid=1798&fos=8&fossub=164
University of the West of England
http://courses.uwe.ac.uk/G4H4/2016
http://courses.uwe.ac.uk/G4HF/2016
Ireland
Blanchardstown Institute of Technology
http://www.itb.ie/studyatitb/bn518.html
University College Dublin
http://www.ucd.ie/cci/education/prospective_students/fcci_programmes/msc_fcci.html
http://www.ucd.ie/cci/education/prospective_students/msc_difc.html
Dublin City University
http://www.computing.dcu.ie/postgraduate/msc-security-and-forensic-computing
Letterkenny Institute of Technology
http://www.lyit.ie/courses/computing/ly737/
http://www.lyit.ie/courses/computing/lyksdfb/
Waterford Institute of Technology
https://www.wit.ie/courses/type/science/department_of_computing_maths_physics/bsc_hons_in_computer_forensics_and_security
https://www.wit.ie/courses/type/science/department_of_computing_maths_physics/diploma-in-computing-with-security-and-forensics-level-7-with-work-placemen
https://www.wit.ie/courses/type/science/department_of_computing_maths_physics/bsc_hons_in_computer_forensics_and_security
Scotland
Edinburgh Napier University
http://www.napier.ac.uk/en/courses/bengbenghons-computer-security--forensics-swe-undergraduate-fulltime
http://www.napier.ac.uk/en/courses/msc-advanced-security-and-digital-forensics-postgraduate-fulltime
University of Glasgow
http://www.gla.ac.uk/coursecatalogue/course/?code=ARTMED5019
Glasgow Caledonian University
http://www.gcu.ac.uk/study/undergraduate/courses/digital-security-forensics-and-ethical-hacking-9373.php?loc=uk
Wales
Cardiff University
http://www.cardiff.ac.uk/study/undergraduate/courses/course/computer-science-with-security-and-forensics-bsc
http://www.cardiff.ac.uk/study/undergraduate/courses/course/computer-science-with-security-and-forensics-with-a-year-in-industry-bsc
University of Glamorgan
http://courses.southwales.ac.uk/courses/563-bsc-hons-computer-forensics
http://courses.southwales.ac.uk/courses/264-msc-computer-forensics
http://courses.southwales.ac.uk/courses/972-bsc-hons-computer-forensics-including-foundation-year
http://courses.southwales.ac.uk/courses/1541-mcomp-hons-computer-forensics
EMPLOYMENT
There are many ways to objectify and define a career path. Some look at the academic route first, some the employment route and others take measured assessments to determine the best path forward. It is whatever suits you best because work in civilian careers is different when working with a public sector agency.
1) Interested in working in the public sector - seek out the agency that is of interest to you and find their careers webpage. Now visit other agencies and see if there is a common theme of interest e.g. computer and smartphone forensics, digital investigations etc.
2) Are the qualifications or experience you need for the vacancy and any training offered?
3) Write to an agency to ask for their public statement on recruiting civilian employees in computer forensics?
4) Ask for the link to their public webpage that describes the equal opportunities the public sector agency is lawfully bound to publicise.
What if the private sector is more appealing to you. The above should still stand you in good stead.
EMPLOYMENT ADVERTISEMENT
Be smart and understand employment advertisements that are simply asking too much e.g. the applicant should be Einstein, know everything, but work for a pittance. These adverts do more harm than good. Apply a litmus test - (a) what is the time period of experience the person would need to qualify for each subject and then (b) how old does the person need to be.
An example of an employment advertisement seen recently, we looked at the Job description compared with the experience the person would need for each of the subject matters set out in the job description.
A test criteria was identified as to what knowledge skill and experience the applicant would need:
a) read a book,
b) 6mths,
c) 2yrs,
d) 5yrs,
e) 10yrs
Computer Science/Criminal Justice: ........ -v- ..........Time period of experience
- Teach undergraduate and graduate courses..........read a book, 6mths, 2yrs, 5yrs, 10yrs
- basic and advanced digital forensics and cyber security...read a book, 6mths, 2yrs, 5yrs 10yrs
- Knowledge of digital evidence and analysis..........read a book, 6mths, 2yrs, 5yrs, 10yrs
- network forensics...................read a book, 6mths, 2yrs, 5yrs, 10yrs
- EnCase....read a book, 6mths, 2yrs, 5yrs, 10yrs
- risk management...read a book, 6mths, 2yrs, 5yrs, 10yrs
- information security...read a book, 6mths, 2yrs, 5yrs, 10yrs
- information assurance compliance.....read a book, 6mths, 2yrs, 5yrs 10yrs
- network defense...read a book, 6mths, 2yrs, 5yrs, 10yrs
- incident response.....read a book, 6mths, 2yrs, 5yrs, 10yrs
- vulnerability assessment......read a book, 6mths, 2yrs, 5yrs, 10yrs
Given the title of the knowledge, skills and experience sought in the job description realistically a candidate would need to have had maybe between 3yrs-5yrs on each subject. This suggests between 33 to 55 years exposure to dealing with those subjects. So a candidate having started out learning at 20 years of age should be between the age of 53 to 75 to apply for the vacancy?
Alternatively, if only three subjects were the primary requirement then possibly 10 years of knowledge skill and experience might be necessary and the other subjects might be covered by reading a book on each subject.
EMPLOYMENT AGENCIES
There are many good employment agencies out there who are sensible and reasonable and define to their clients that given the sum of money they want to pay for the vacancy there needs to be incentives defined for extra knowledge, skills and experience being brought in-house that the company sells as a service to customers as value-added services. And that is a key-point for potential recruits - what VALUE-ADDED knowledge, skills and experience could you offer above the job description. Never, ever agree to provide every bit knowledge, skills and experience defined in an advertisement.
FIND OUT ABOUT EMPLOYER JOB ADVERTS
Absolute goal for research and during interviews:
i) Know the company you want to work for?
ii) Know who are their major competitors?
iii) Seek out the companies market share?
iv) Know whether you can assist maintain their current share or improve on it (e.g. Value Added)?
v) What is the financial status of the company?
vi) Whilst potential employers want to know your life story you equally have the right to know their story, too?
vii) Don't turn down a good job for one thought to be better, only to find out the latter company is using short term government grants to get people off unemployment. Check what is meant by probationary period.
UNIVERSITIES
I have updated, as of today (20/12/2015), a list of Universities in England, Wales, Scotland and Ireland offering computer forensic courses for 2016 that are stand alone or incorporated with another subject matter.
These are useful website to find out about the educational qualifications available for computer forensics and related subjects. I haven't hinted my suggestions about the courses because some fundamental requirements of any forensics discipline is that a person's learns how to:
(1) source information
(2) thoroughly research
(3) identify salient details and facts
University of Bedfordshire
http://www.beds.ac.uk/howtoapply/courses/undergraduate/current-year/computer-security-and-forensics
Birmingham City University
http://www.bcu.ac.uk/courses/forensic-computing
Canterbury Christ Church University
http://www.canterbury.ac.uk/study-here/courses/undergraduate/computer-forensics-and-security.aspx
Cranfield University
http://www.cranfield.ac.uk/courses/masters/forensic-computing.html
De Montfort University
http://www.dmu.ac.uk/study/courses/undergraduate-courses/forensic-computing.aspx
University of Derby
http://www.derby.ac.uk/courses/computer-networks-security-bsc-hons/
http://www.derby.ac.uk/courses/computer-forensics-bsc-hons/
University of Gloucestershire
http://www.glos.ac.uk/courses/descriptors/pages/ct5020-foundations-of-forensic-tools-and-techniques.aspx
http://www.glos.ac.uk/courses/descriptors/pages/ct5021-network-design-security-forensics.aspx
http://www.glos.ac.uk/courses/descriptors/pages/ct5024-cryptography-and-forensics.aspx
University of Greenwich
http://search.gre.ac.uk/s/search.html?collection=website-meta&form=simple-15&profile=_default&query=computer+forensics
University of Central Lancashire
http://www.uclan.ac.uk/courses/bsc_forensic_computing_foundation_entry.php
http://www.uclan.ac.uk/courses/bsc_hons_forensic_computing.php
Leeds Metropolitan University
http://courses.leedsbeckett.ac.uk/computerforensics
http://courses.leedsbeckett.ac.uk/computerforensicssecurity
http://courses.leedsbeckett.ac.uk/digitalforensics_security_msc
Liverpool John Moores University
https://www.ljmu.ac.uk/study/courses/undergraduates/2016/computer-forensics-with-foundation-year-bsc
https://www.ljmu.ac.uk/study/courses/undergraduates/2016/computer-forensics-mcomp
https://www.ljmu.ac.uk/study/courses/undergraduates/2016/computer-forensics
https://www.ljmu.ac.uk/study/courses/postgraduates/computer-forensics
University of East London
http://www.uel.ac.uk/postgraduate/specs/iscf/
London Metropolitan University
http://www.londonmet.ac.uk/courses/undergraduate/2016/computer-forensics-and-it-security---bsc-hons/
University of London - Royal Holloway
https://www.royalholloway.ac.uk/isg/prospectivestudents/prospectivestudents-msc/home.aspx
Manchester Metropolitan University
http://www2.mmu.ac.uk/study/undergraduate/courses/2016/13055/
Middlesex University
http://www.mdx.ac.uk/courses/undergraduate/computer-forensics
Northumbria University
https://www.northumbria.ac.uk/study-at-northumbria/courses/computer-and-digital-forensics-mcomp-uuscdi1/
The Open University
http://www.open.ac.uk/postgraduate/modules/m812
http://www.open.edu/openlearn/science-maths-technology/computing-and-ict/introduction-computer-forensics-and-investigations/content-section-0
University of Portsmouth
http://www.port.ac.uk/courses/computing-and-creative-technologies/bsc-hons-forensic-computing/
Sheffield Hallam University
http://www.shu.ac.uk/prospectus/course/1097/
Staffordshire University
http://www.staffs.ac.uk/course/SSTK-11000.jsp
University of Sunderland
http://www.sunderland.ac.uk/courses/appliedsciences/undergraduate/computer-forensics/
Teesside University
http://www.tees.ac.uk/prospectus/ug/UG_course.cfm?courseid=121&fos=8&fossub=22
http://www.tees.ac.uk/prospectus/ug/UG_course.cfm?courseid=1797&fos=8&fossub=164
http://www.tees.ac.uk/prospectus/ug/UG_course.cfm?courseid=1311&fos=8&fossub=22
http://www.tees.ac.uk/prospectus/ug/UG_course.cfm?courseid=1798&fos=8&fossub=164
University of the West of England
http://courses.uwe.ac.uk/G4H4/2016
http://courses.uwe.ac.uk/G4HF/2016
Ireland
Blanchardstown Institute of Technology
http://www.itb.ie/studyatitb/bn518.html
University College Dublin
http://www.ucd.ie/cci/education/prospective_students/fcci_programmes/msc_fcci.html
http://www.ucd.ie/cci/education/prospective_students/msc_difc.html
Dublin City University
http://www.computing.dcu.ie/postgraduate/msc-security-and-forensic-computing
Letterkenny Institute of Technology
http://www.lyit.ie/courses/computing/ly737/
http://www.lyit.ie/courses/computing/lyksdfb/
Waterford Institute of Technology
https://www.wit.ie/courses/type/science/department_of_computing_maths_physics/bsc_hons_in_computer_forensics_and_security
https://www.wit.ie/courses/type/science/department_of_computing_maths_physics/diploma-in-computing-with-security-and-forensics-level-7-with-work-placemen
https://www.wit.ie/courses/type/science/department_of_computing_maths_physics/bsc_hons_in_computer_forensics_and_security
Scotland
Edinburgh Napier University
http://www.napier.ac.uk/en/courses/bengbenghons-computer-security--forensics-swe-undergraduate-fulltime
http://www.napier.ac.uk/en/courses/msc-advanced-security-and-digital-forensics-postgraduate-fulltime
University of Glasgow
http://www.gla.ac.uk/coursecatalogue/course/?code=ARTMED5019
Glasgow Caledonian University
http://www.gcu.ac.uk/study/undergraduate/courses/digital-security-forensics-and-ethical-hacking-9373.php?loc=uk
Wales
Cardiff University
http://www.cardiff.ac.uk/study/undergraduate/courses/course/computer-science-with-security-and-forensics-bsc
http://www.cardiff.ac.uk/study/undergraduate/courses/course/computer-science-with-security-and-forensics-with-a-year-in-industry-bsc
University of Glamorgan
http://courses.southwales.ac.uk/courses/563-bsc-hons-computer-forensics
http://courses.southwales.ac.uk/courses/264-msc-computer-forensics
http://courses.southwales.ac.uk/courses/972-bsc-hons-computer-forensics-including-foundation-year
http://courses.southwales.ac.uk/courses/1541-mcomp-hons-computer-forensics
Saturday, November 21, 2015
BYOD - CJIS MOBILE APPENDIX - FBI
Bring Your Own (BYO) what?
Take away the scenario of government and local authorities involvement and merely consider private industry then the latter may have no enforcement rights to control BYOD (bring your own device) smartphone usage as these employees and out-source workers are being used and are paying for company communications out of their wages/salary merely so that a natural business costs can be reduced or removed. Reported patterns of abuse by BYOD employees are scarce as are, funnily enough, the cost savings made by companies and as a consequence of the saving the beneficiaries of those company cost savings. What is the employment position to refuse BYOD? And what about employees and staff on wages and salaries under e.g. £40K down to national minimum wage; are they protected?
This "Bring Your Own" approach in business seemingly is not limited to devices. There is an instance of even an employer seeking to reduce vehicle fleet insurance costs by seeking the employee to have the company vehicle insured in their own name. So do we call this BYOI (bring your own insurance)? Significant problems could arise though if those company vehicles carry hazard items not disclosed to the insurance company. Moreover, would employees find themselves being coerced in the workplace if they refuse to comply?
Given the vast increase in personal mobile devices in the workplace the UK Parliament may need to consider preventative legislation to stop employer abuses in all cases of "Bring Your Own" (BYO) whether device orientated or not without punishing the employee to pursue some form of equitable estopple (a doctrine preventing one party from taking unfair advantage of another perhaps through false language or conduct) legal action where the employers tries to treat employees as if the employee is somehow holding out in the course of a business (UCTA 1977).
God forbid the next thing is BYOM (bring your own mortgage) to pay for the company office building.
BYOD - CJIS MOBILE APPENDIX - FBI
FBI analysis of BYOD. There are many references to BYOD in the report, but two statements applicable to employees and out-source workers where they use their own devices are noteworthy at 1.7.3 and 1.10.2 below.
1.7.3 Bring Your Own device (BYOD) employment
BYOD environments pose significant challenges to the management of secure device configurations. In many cases it may be impossible to apply effective security that is acceptable to the device owner or it may require extremely costly compensating controls to allow access to CJI on personally owned devices. While allowed by the CJIS Security Policy, agencies are advised to conduct a detailed cost analysis of the ancillary costs of compliance with CJIS Security Policy on personally owned devices when they are approved for use. In some cases, a BYOD user may agree to abide by the same device configurations and limitations as imposed on an agency owned device, but signed user agreements should still be in place to ensure the agency has a legal right to recover or clear the device of all data prior to device disposal or employee termination. In other cases, robust secure applications may provide acceptable levels of compliance in a BYOD environment for limited CJI access but application design and architecture should assume the device itself is un-trusted. If MDM/EMM software capable of detecting rooting or jailbreaking of the device is not installed, any CJIS or data access occurring from the device is at a substantially higher risk of compromise.
1.10.2 Malicious code protection/Restriction of installed applications and application permissions
The most common method of malicious code installation is enticing the user to manually install the malicious app which can be mitigated on organizational devices using an MDM or other application installation restrictions which prevent the user from installing unauthorized or unknown applications. Mitigation of this issue within BYOD environments may not be possible and will present a significantly enhanced risk to the device.
https://www.fbi.gov/about-us/cjis/CJIS%20Mobile%20Mobile%20Appendix%2020121214.pdf
Previous Discussions:
BYOD: Cyber Classification
http://trewmte.blogspot.co.uk/2015/08/byod-cyber-classification.html
Android Copy and Paste - what risks?
http://trewmte.blogspot.co.uk/2015/06/android-copy-and-paste-what-risks.html
BYOD risks and minefields
http://trewmte.blogspot.co.uk/2014/03/byod-risks-and-minefields.html
One hit, hits all
http://trewmte.blogspot.co.uk/2013/02/one-hit-hits-all.html
Smartphone BYOD
http://trewmte.blogspot.co.uk/2013/01/smartphone-byod.html
Take away the scenario of government and local authorities involvement and merely consider private industry then the latter may have no enforcement rights to control BYOD (bring your own device) smartphone usage as these employees and out-source workers are being used and are paying for company communications out of their wages/salary merely so that a natural business costs can be reduced or removed. Reported patterns of abuse by BYOD employees are scarce as are, funnily enough, the cost savings made by companies and as a consequence of the saving the beneficiaries of those company cost savings. What is the employment position to refuse BYOD? And what about employees and staff on wages and salaries under e.g. £40K down to national minimum wage; are they protected?
This "Bring Your Own" approach in business seemingly is not limited to devices. There is an instance of even an employer seeking to reduce vehicle fleet insurance costs by seeking the employee to have the company vehicle insured in their own name. So do we call this BYOI (bring your own insurance)? Significant problems could arise though if those company vehicles carry hazard items not disclosed to the insurance company. Moreover, would employees find themselves being coerced in the workplace if they refuse to comply?
Given the vast increase in personal mobile devices in the workplace the UK Parliament may need to consider preventative legislation to stop employer abuses in all cases of "Bring Your Own" (BYO) whether device orientated or not without punishing the employee to pursue some form of equitable estopple (a doctrine preventing one party from taking unfair advantage of another perhaps through false language or conduct) legal action where the employers tries to treat employees as if the employee is somehow holding out in the course of a business (UCTA 1977).
God forbid the next thing is BYOM (bring your own mortgage) to pay for the company office building.
BYOD - CJIS MOBILE APPENDIX - FBI
FBI analysis of BYOD. There are many references to BYOD in the report, but two statements applicable to employees and out-source workers where they use their own devices are noteworthy at 1.7.3 and 1.10.2 below.
1.7.3 Bring Your Own device (BYOD) employment
BYOD environments pose significant challenges to the management of secure device configurations. In many cases it may be impossible to apply effective security that is acceptable to the device owner or it may require extremely costly compensating controls to allow access to CJI on personally owned devices. While allowed by the CJIS Security Policy, agencies are advised to conduct a detailed cost analysis of the ancillary costs of compliance with CJIS Security Policy on personally owned devices when they are approved for use. In some cases, a BYOD user may agree to abide by the same device configurations and limitations as imposed on an agency owned device, but signed user agreements should still be in place to ensure the agency has a legal right to recover or clear the device of all data prior to device disposal or employee termination. In other cases, robust secure applications may provide acceptable levels of compliance in a BYOD environment for limited CJI access but application design and architecture should assume the device itself is un-trusted. If MDM/EMM software capable of detecting rooting or jailbreaking of the device is not installed, any CJIS or data access occurring from the device is at a substantially higher risk of compromise.
1.10.2 Malicious code protection/Restriction of installed applications and application permissions
The most common method of malicious code installation is enticing the user to manually install the malicious app which can be mitigated on organizational devices using an MDM or other application installation restrictions which prevent the user from installing unauthorized or unknown applications. Mitigation of this issue within BYOD environments may not be possible and will present a significantly enhanced risk to the device.
https://www.fbi.gov/about-us/cjis/CJIS%20Mobile%20Mobile%20Appendix%2020121214.pdf
Previous Discussions:
BYOD: Cyber Classification
http://trewmte.blogspot.co.uk/2015/08/byod-cyber-classification.html
Android Copy and Paste - what risks?
http://trewmte.blogspot.co.uk/2015/06/android-copy-and-paste-what-risks.html
BYOD risks and minefields
http://trewmte.blogspot.co.uk/2014/03/byod-risks-and-minefields.html
One hit, hits all
http://trewmte.blogspot.co.uk/2013/02/one-hit-hits-all.html
Smartphone BYOD
http://trewmte.blogspot.co.uk/2013/01/smartphone-byod.html
Sunday, October 25, 2015
Digital Evidence - Disciples and Pilgrams
A career in the Digital Evidence field is a journey of lifelong learning. The length of that journey depends on you, no matter whether you are young or old. There are no masters, no experts, just you and me on this road of discovery. We are disciples and pilgrims of and for this art we enjoy and wish to follow, running to keep pace in a technological-world of constant change.
Painting by Eugène Burnand hangs in the Musée d’Orsay Gallery in Paris. Les
disciples Jean et Pierre accourant au sépulcre le matin de la résurrection.
disciples Jean et Pierre accourant au sépulcre le matin de la résurrection.
Sunday, September 13, 2015
Metrology - USB part 2
Continuing with the discussion relating to Metrology and Universal Serial Bus (USB) cables.
Metrology - http://trewmte.blogspot.co.uk/2015/05/metrology.html
In the first discussion it raised the observations iso9001 has been mentioned and this standard provides a useful guide on record keeping. In most cases users take for granted that the cable/lead/plug is ok and just swap it out if it is deemed not working? Simple questions:
1) Is there a cable/lead tester on the market?
2) What results can be obtained?
3) How to determine output results?
4) Compare manufacturing guidelines for MTTF and MTBF?
5) Can the results scrutinised be improved?
6) Can a minimum standard be achieved.
Metrology - USB part 1 - http://trewmte.blogspot.co.uk/2015/06/metrology-usb-part-1.html
Later the discussion raised the notion that smartphones, tablets and other devices fitting the description Size-Scaled Digital Technology (SSDT) using USB physical connectivity provides for the simplest of examination DUT illustrations e.g. the combination of three separate entities involved in inter-connection during an examination:
1) DUT (the target device (SSDT) containing suspected evidence
2) The physical medium (USB) to carry the source data to the examination tool
3) The examination tool (ET) used to extract and harvest evidence
And ended with the point that the discussion started out by referring to the physical medium USB to carry the source data from the DUT to the examination tool (ET). The relevance of doing so is that if the examiner eliminates the medium as the cause for failure or corrupted evidence then the logical conundrum that remains, is the DUT at fault, is the ET at fault or are both DUT/ET together faulty?
In order to eliminate the USB cable's involvement in the acquisition process as the source of causing corrupted data or inducing faults into the DUT requires expanding the investigation of what is known about USB tolerances or identified faults.
Mechanical Failures
Types of USB connector left to right (ruler in centimetres): micro-B plug, UC-E6 proprietary (non-USB) plug, mini-B plug, standard-A receptacle (upside down), standard-A plug, standard-B plug
The procedure required to dissect and strip back a USB plug from its cable. In itself, there is nothing special in this task being performed other than for revelation purposes to allow observations of what is happening underneath the main moulded cable covering, due to the fact that the human eye does not possess x-ray vision. This USB cable was chosen as it had visible signs of wear and tear at the USB plug end that connects to the device (DUT) and charging of a DUT was known to be intermittent.
The USB cable was terminated at either end with a mini-B plug and standard-A plug. The photo below shows the mini-B plug end has been dissected and stripped back.
The standard coloured wiring is expressed as:
It was noticeable from a study of the separate coloured internal wire covers - Green, Red, Black and White ( For a quick reference source refer to https://en.wikipedia.org/wiki/USB. ) - that the Red wire cover was in fact a Pink in colour with deterioration (more brittle, easy to pull off covering) than the other coloured coverings.
Given that the mini-B plug is the end that is connected into the DUT raises concerns as to whether the wear and tear could cause damage to the DUT, too. As the Red(Pink) coloured cover concerns the power VCC (+5 V, red wire) it is not difficult to speculate the potential for damage or failure and that on the balance of probability (at one of the end of the scale) the quality assurance programme should have identified this as a problem or issue to be addressed, (and at the other end of the scale) that beyond reasonable doubt the quality control processes should have removed this physical medium (USB cable) from the pool of tools/devices that could be used during an examination process.
The sampling rates for conducted Vbus and Vcc etc tests can be deduced from the USB standards. Full USB compliance test equipment maybe expensive for those who are trading as a one-man business. There are some simple test rigs out there which require the use of a digital multimeter and test cables that may offer a lower cost solution worth investigating.
One such rig is USB Tester from Fried Circuits http://friedcircuits.us/docs/usb-tester
Another rig from the same source is USB Tester and Phone Charging http://friedcircuits.us/docs/usb-tester-and-phone-charging/
Inexpensive rigs like these should not be a problem but it is essential to carefully document their use in your QA procedures and their requirement to be calibrated.
There are still numerous matters to discuss that have been identified regarding Metrology and USB, which shall be published shortly. The total sum of these discussion Parts build eventually to an identified set of criteria that examiners may wish to apply for QA purposes to reduce or remove the medium USB as having an adverse impact during data acquisition between a DUT and the ET.
Metrology - http://trewmte.blogspot.co.uk/2015/05/metrology.html
In the first discussion it raised the observations iso9001 has been mentioned and this standard provides a useful guide on record keeping. In most cases users take for granted that the cable/lead/plug is ok and just swap it out if it is deemed not working? Simple questions:
1) Is there a cable/lead tester on the market?
2) What results can be obtained?
3) How to determine output results?
4) Compare manufacturing guidelines for MTTF and MTBF?
5) Can the results scrutinised be improved?
6) Can a minimum standard be achieved.
Metrology - USB part 1 - http://trewmte.blogspot.co.uk/2015/06/metrology-usb-part-1.html
Later the discussion raised the notion that smartphones, tablets and other devices fitting the description Size-Scaled Digital Technology (SSDT) using USB physical connectivity provides for the simplest of examination DUT illustrations e.g. the combination of three separate entities involved in inter-connection during an examination:
1) DUT (the target device (SSDT) containing suspected evidence
2) The physical medium (USB) to carry the source data to the examination tool
3) The examination tool (ET) used to extract and harvest evidence
And ended with the point that the discussion started out by referring to the physical medium USB to carry the source data from the DUT to the examination tool (ET). The relevance of doing so is that if the examiner eliminates the medium as the cause for failure or corrupted evidence then the logical conundrum that remains, is the DUT at fault, is the ET at fault or are both DUT/ET together faulty?
In order to eliminate the USB cable's involvement in the acquisition process as the source of causing corrupted data or inducing faults into the DUT requires expanding the investigation of what is known about USB tolerances or identified faults.
Mechanical Failures
The procedure required to dissect and strip back a USB plug from its cable. In itself, there is nothing special in this task being performed other than for revelation purposes to allow observations of what is happening underneath the main moulded cable covering, due to the fact that the human eye does not possess x-ray vision. This USB cable was chosen as it had visible signs of wear and tear at the USB plug end that connects to the device (DUT) and charging of a DUT was known to be intermittent.
The USB cable was terminated at either end with a mini-B plug and standard-A plug. The photo below shows the mini-B plug end has been dissected and stripped back.
The standard coloured wiring is expressed as:
| Pin 1 | VCC (+5 V, red wire) | |
|---|---|---|
| Pin 2 | Data− (white wire) | |
| Pin 3 | Data+ (green wire) | |
| Pin 4 | Ground (black wire) |
It was noticeable from a study of the separate coloured internal wire covers - Green, Red, Black and White ( For a quick reference source refer to https://en.wikipedia.org/wiki/USB. ) - that the Red wire cover was in fact a Pink in colour with deterioration (more brittle, easy to pull off covering) than the other coloured coverings.
Given that the mini-B plug is the end that is connected into the DUT raises concerns as to whether the wear and tear could cause damage to the DUT, too. As the Red(Pink) coloured cover concerns the power VCC (+5 V, red wire) it is not difficult to speculate the potential for damage or failure and that on the balance of probability (at one of the end of the scale) the quality assurance programme should have identified this as a problem or issue to be addressed, (and at the other end of the scale) that beyond reasonable doubt the quality control processes should have removed this physical medium (USB cable) from the pool of tools/devices that could be used during an examination process.
The sampling rates for conducted Vbus and Vcc etc tests can be deduced from the USB standards. Full USB compliance test equipment maybe expensive for those who are trading as a one-man business. There are some simple test rigs out there which require the use of a digital multimeter and test cables that may offer a lower cost solution worth investigating.
One such rig is USB Tester from Fried Circuits http://friedcircuits.us/docs/usb-tester
Another rig from the same source is USB Tester and Phone Charging http://friedcircuits.us/docs/usb-tester-and-phone-charging/
Inexpensive rigs like these should not be a problem but it is essential to carefully document their use in your QA procedures and their requirement to be calibrated.
There are still numerous matters to discuss that have been identified regarding Metrology and USB, which shall be published shortly. The total sum of these discussion Parts build eventually to an identified set of criteria that examiners may wish to apply for QA purposes to reduce or remove the medium USB as having an adverse impact during data acquisition between a DUT and the ET.
Monday, August 31, 2015
First woman to write a computer program
Next year 2016 it will be 200th birthday of Augusta Ada King, Countess of Lovelace, born 1816. Ada Lovelace is said to be the first woman said to have written the first computer program in October 1843 translated from Menabrea’s paper "Notions sur la machine analytique de M. Charles Babbage" (1842).
Ada's work recorded in Sketch of the Analytical Engine invented by Charles Babbage -Translation originally published in 1843 in the Scientific Memoirs, 3, 666-73 and one folding chart. This work represented the first edition in English of the first published account of Babbage’s Analytical Engine, and, significantly, of its logical design (http://psychclassics.yorku.ca/Lovelace/menabrea.htm).
Bromley, Allan G; referred toAda's translation as “the most important paper in the history of digital computing before modern times” - "The Evolution of Babbage's Calculating Engines, xv" Annals of the History of Computing, 9 (1987).
A more pragmatic explanation (The Cogwheel Brain at 165 by Swade, Doron David published in 2000) of Ada's work that when supplied with algorithms for the solution of various problems, Ada illustrated in her notes in the form of charts detailing step-wise sequence of events as the machine progressed through a string of instructions input from punched cards. It is Ada's finite work that many have referred as recognised in the 20th Century as the first published example of a [computer] "program".
Great woman, unique story and fascinating event in computing history and for the development of information systems.
The information in this discussion is condensed from numerous sources and searches.
History Links
http://psychclassics.yorku.ca/Lovelace/menabrea.htm
https://en.wikipedia.org/wiki/Ada_Lovelace
http://www.historyofinformation.com/expanded.php?id=547
http://www.sophiararebooks.com/pictures/3544a.jpg
Lovelace's diagram from Note G - photo courtesy of http://www.sophiararebooks.com/pictures/3544a.jpg
Ada's work recorded in Sketch of the Analytical Engine invented by Charles Babbage -Translation originally published in 1843 in the Scientific Memoirs, 3, 666-73 and one folding chart. This work represented the first edition in English of the first published account of Babbage’s Analytical Engine, and, significantly, of its logical design (http://psychclassics.yorku.ca/Lovelace/menabrea.htm).
Bromley, Allan G; referred toAda's translation as “the most important paper in the history of digital computing before modern times” - "The Evolution of Babbage's Calculating Engines, xv" Annals of the History of Computing, 9 (1987).
A more pragmatic explanation (The Cogwheel Brain at 165 by Swade, Doron David published in 2000) of Ada's work that when supplied with algorithms for the solution of various problems, Ada illustrated in her notes in the form of charts detailing step-wise sequence of events as the machine progressed through a string of instructions input from punched cards. It is Ada's finite work that many have referred as recognised in the 20th Century as the first published example of a [computer] "program".
Great woman, unique story and fascinating event in computing history and for the development of information systems.
The information in this discussion is condensed from numerous sources and searches.
History Links
http://psychclassics.yorku.ca/Lovelace/menabrea.htm
https://en.wikipedia.org/wiki/Ada_Lovelace
http://www.historyofinformation.com/expanded.php?id=547
http://www.sophiararebooks.com/pictures/3544a.jpg
Tuesday, August 11, 2015
BYOD: Cyber Classification
Having an effective Cyber defence requires " identification " of the methodology proposed for each measures adopted in the Critical Security Controls (CSC) programme. The Critical Security Controls listed below has been developed from the combined knowledge of actual attacks and effective defences of experts from every part of the cyber security ecosystem.
CSC 1: Inventory of Authorized and Unauthorized Devices
CSC 2: Inventory of Authorized and Unauthorized Software
CSC 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
CSC 4: Continuous Vulnerability Assessment and Remediation
CSC 5: Malware Defences
CSC 6: Application Software Security
CSC 7: Wireless Access Control
CSC 8: Data Recovery Capability
CSC 9: Security Skills Assessment and Appropriate Training to Fill Gaps
CSC 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
CSC 11: Limitation and Control of Network Ports, Protocols, and Services
CSC 12: Controlled Use of Administrative Privileges
CSC 13: Boundary Defence
CSC 14: Maintenance, Monitoring, and Analysis of Audit Logs
CSC 15: Controlled Access Based on the Need to Know
CSC 16: Account Monitoring and Control
CSC 17: Data Protection
CSC 18: Incident Response and Management
CSC 19: Secure Network Engineering
CSC 20: Penetration Tests and Red Team Exercises
It is not surprising that given the adoption of CSC classifications it would be in the interests of organisations to adopt the short form code associated with the Critical Security Control in place found to have been breached. For instance where a BYOD is found to be the cause of the breach it may be said a CSC-7 breach took place. The use of a short form code
(i) informs immediately those who are aware of the short form code of the style of breach taken place.
(ii) creates standardization across the organisation
(iii) enables an organisation's first responder to identify and locate BYODs
(iv) labels a breach in accordance with internationally recognised CSC classification
(v) removes the need for organisations to generate in-house difficult and complex classifications that later require translation e.g. technically, legally, commercially......
CSC 7: Wireless Access Control
The processes and tools used to track/control/prevent/correct the security use of wireless local area networks (LANs), access points, and wireless client systems.
Why Is This Control Critical?
Major thefts of data have been initiated by attackers who have gained wireless access to organizations from outside the physical building, bypassing organizations' security perimeters by connecting wirelessly to access points inside the organization. Wireless clients accompanying traveling officials are infected on a regular basis through remote exploitation during air travel or in cyber cafes. Such exploited systems are then used as back doors when they are reconnected to the network of a target organization. Still other organizations have reported the discovery of unauthorized wireless access points on their networks, planted and sometimes hidden for unrestricted access to an internal network. Because they do not require direct physical connections, wireless devices are a convenient vector for attackers to maintain long-term access into a target environment.
CSC 7 Procedures and Tools
Effective organizations run commercial wireless scanning, detection, and discovery tools as well as commercial wireless intrusion detection systems.
Additionally, the security team should periodically capture wireless traffic from within the borders of a facility and use free and commercial analysis tools to determine whether the wireless traffic was transmitted using weaker protocols or encryption than the organization mandates. When devices relying on weak wireless security settings are identified, they should be found within the organization's asset inventory and either reconfigured more securely or denied access to the
organization network.
Additionally, the security team should employ remote management tools on the wired network to pull information about the wireless capabilities and devices connected to managed systems.
CSC 7 Effectiveness Metrics
In order to test the effectiveness of the automated implementation of this control, organizations should measure the following:
1) Are systems capable of identifying unauthorized wireless devices or configurations when they are within range of the organization's systems or connected to their networks (yes or no)?
2) How long does it take to generate alerts about unauthorized wireless devices that are detected (time in minutes)?
3) How long does it take for unauthorized wireless devices to be blocked from connecting or isolated from the network (time in minutes)?
4) Are additional alerts generated every 24 hours after the initial alert until the system is isolated or removed from the network (yes or no)?
5) Is the system able to identify the location, department, and other details of where authorized and unauthorized wireless devices are plugged into the network (yes or no)?
CSC 7 Automation Metrics
In order to automate the collection of relevant data from these systems, organizations should gather the following information with automated technical sensors:
1) How many rogue wireless access points have been discovered recently in the organization (by business unit)? This should include non-persistent, temporary and transient access points.
2) What is the average time that it takes to remove rogue access points from the organization's network (by business unit)?
3) How many wireless access points or clients have been discovered using an unauthorized wireless configuration recently in the organization (by business unit)?
CSC 7 Effectiveness Test
To evaluate the implementation of Control 7 on a periodic basis, the evaluation team has to configure 10 unauthorized but hardened wireless clients and wireless access points to the organization's network and attempt to connect them to its wireless networks. In the case of wireless access points, these access points have to not be directly connected to the organization's trusted network. Instead, they have to simply be configured to act as a wireless gateway without physically connecting to a wired network interface. In the case of scanning for wireless access points from a wired interface, the connected access point has to have the wireless radio disabled for the duration of the test. These systems have to be configured to test each of the following scenarios:
• A wireless client with an unauthorized service set identifier configured on it.
• A wireless client with improper encryption configured.
• A wireless client with improper authentication configured.
• A wireless access point with improper encryption configured.
• A wireless access point with improper authentication configured.
• A completely rogue wireless access point using an unauthorized configuration.
When any of the above-noted systems attempt to connect to the wireless network, an alert has to be generated and enterprise staff has to respond to the alerts to isolate the detected device or remove the device from the network.
CSC 7 System Entity Relationship Diagram
Organizations will find that by diagramming the entities necessary to fully meet the goals defined in this control, it will be easier to identify how to implement them, test the controls, and identify where potential failures in the system might occur.
A control system is a device or set of devices used to manage, command, direct, or regulate the behaviour of other devices or systems. In this case, we are examining the configuration and management of wireless devices, wireless IDS/scanners, wireless device management systems, and vulnerability scanners. The list of the steps shows how the entities work together to meet the business goal defined in this control. The list also delineates each of the process steps in order to help identify potential failure points in the overall control.
• Step 1: Hardened configurations applied to wireless devices.
• Step 2: Hardened configurations managed by a configuration management system.
• Step 3: Configuration management system manages the configurations on wireless devices.
• Step 4: Wireless IDS monitor usage of wireless communications.
• Step 5: Vulnerability scanners scan wireless devices for potential vulnerabilities.
• Step 6: Wireless clients utilize wireless infrastructure systems in a secure manner.
CSC 1: Inventory of Authorized and Unauthorized Devices
CSC 2: Inventory of Authorized and Unauthorized Software
CSC 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
CSC 4: Continuous Vulnerability Assessment and Remediation
CSC 5: Malware Defences
CSC 6: Application Software Security
CSC 7: Wireless Access Control
CSC 8: Data Recovery Capability
CSC 9: Security Skills Assessment and Appropriate Training to Fill Gaps
CSC 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
CSC 11: Limitation and Control of Network Ports, Protocols, and Services
CSC 12: Controlled Use of Administrative Privileges
CSC 13: Boundary Defence
CSC 14: Maintenance, Monitoring, and Analysis of Audit Logs
CSC 15: Controlled Access Based on the Need to Know
CSC 16: Account Monitoring and Control
CSC 17: Data Protection
CSC 18: Incident Response and Management
CSC 19: Secure Network Engineering
CSC 20: Penetration Tests and Red Team Exercises
It is not surprising that given the adoption of CSC classifications it would be in the interests of organisations to adopt the short form code associated with the Critical Security Control in place found to have been breached. For instance where a BYOD is found to be the cause of the breach it may be said a CSC-7 breach took place. The use of a short form code
(i) informs immediately those who are aware of the short form code of the style of breach taken place.
(ii) creates standardization across the organisation
(iii) enables an organisation's first responder to identify and locate BYODs
(iv) labels a breach in accordance with internationally recognised CSC classification
(v) removes the need for organisations to generate in-house difficult and complex classifications that later require translation e.g. technically, legally, commercially......
CSC 7: Wireless Access Control
The processes and tools used to track/control/prevent/correct the security use of wireless local area networks (LANs), access points, and wireless client systems.
Why Is This Control Critical?
Major thefts of data have been initiated by attackers who have gained wireless access to organizations from outside the physical building, bypassing organizations' security perimeters by connecting wirelessly to access points inside the organization. Wireless clients accompanying traveling officials are infected on a regular basis through remote exploitation during air travel or in cyber cafes. Such exploited systems are then used as back doors when they are reconnected to the network of a target organization. Still other organizations have reported the discovery of unauthorized wireless access points on their networks, planted and sometimes hidden for unrestricted access to an internal network. Because they do not require direct physical connections, wireless devices are a convenient vector for attackers to maintain long-term access into a target environment.
CSC 7 Procedures and Tools
Effective organizations run commercial wireless scanning, detection, and discovery tools as well as commercial wireless intrusion detection systems.
Additionally, the security team should periodically capture wireless traffic from within the borders of a facility and use free and commercial analysis tools to determine whether the wireless traffic was transmitted using weaker protocols or encryption than the organization mandates. When devices relying on weak wireless security settings are identified, they should be found within the organization's asset inventory and either reconfigured more securely or denied access to the
organization network.
Additionally, the security team should employ remote management tools on the wired network to pull information about the wireless capabilities and devices connected to managed systems.
CSC 7 Effectiveness Metrics
In order to test the effectiveness of the automated implementation of this control, organizations should measure the following:
1) Are systems capable of identifying unauthorized wireless devices or configurations when they are within range of the organization's systems or connected to their networks (yes or no)?
2) How long does it take to generate alerts about unauthorized wireless devices that are detected (time in minutes)?
3) How long does it take for unauthorized wireless devices to be blocked from connecting or isolated from the network (time in minutes)?
4) Are additional alerts generated every 24 hours after the initial alert until the system is isolated or removed from the network (yes or no)?
5) Is the system able to identify the location, department, and other details of where authorized and unauthorized wireless devices are plugged into the network (yes or no)?
CSC 7 Automation Metrics
In order to automate the collection of relevant data from these systems, organizations should gather the following information with automated technical sensors:
1) How many rogue wireless access points have been discovered recently in the organization (by business unit)? This should include non-persistent, temporary and transient access points.
2) What is the average time that it takes to remove rogue access points from the organization's network (by business unit)?
3) How many wireless access points or clients have been discovered using an unauthorized wireless configuration recently in the organization (by business unit)?
CSC 7 Effectiveness Test
To evaluate the implementation of Control 7 on a periodic basis, the evaluation team has to configure 10 unauthorized but hardened wireless clients and wireless access points to the organization's network and attempt to connect them to its wireless networks. In the case of wireless access points, these access points have to not be directly connected to the organization's trusted network. Instead, they have to simply be configured to act as a wireless gateway without physically connecting to a wired network interface. In the case of scanning for wireless access points from a wired interface, the connected access point has to have the wireless radio disabled for the duration of the test. These systems have to be configured to test each of the following scenarios:
• A wireless client with an unauthorized service set identifier configured on it.
• A wireless client with improper encryption configured.
• A wireless client with improper authentication configured.
• A wireless access point with improper encryption configured.
• A wireless access point with improper authentication configured.
• A completely rogue wireless access point using an unauthorized configuration.
When any of the above-noted systems attempt to connect to the wireless network, an alert has to be generated and enterprise staff has to respond to the alerts to isolate the detected device or remove the device from the network.
CSC 7 System Entity Relationship Diagram
Organizations will find that by diagramming the entities necessary to fully meet the goals defined in this control, it will be easier to identify how to implement them, test the controls, and identify where potential failures in the system might occur.
• Step 1: Hardened configurations applied to wireless devices.
• Step 2: Hardened configurations managed by a configuration management system.
• Step 3: Configuration management system manages the configurations on wireless devices.
• Step 4: Wireless IDS monitor usage of wireless communications.
• Step 5: Vulnerability scanners scan wireless devices for potential vulnerabilities.
• Step 6: Wireless clients utilize wireless infrastructure systems in a secure manner.
Sunday, August 02, 2015
National Digital Science and Justice Office (NDSJO)
A recent forum discussion I read recently mentioned a Digital Forensics Capability Review. The discussion also identified the document that forms the basis of this review: http://www.researchgate.net/publication/269332581_Digital_Forensics__Capability_Review
There were some good responses from forum members. Those responses combined with the initial enquiry and the download reference document suggested to me that keep tinkering here and there with different elements in "digital forensics" is perhaps why there is no real substantive change consolidating "digital forensics". There is a desire to galvanise a unifying system but as digital forensics is made up of so many constituent elements it maybe quite difficult to know where to start.
Some observations:
1) Industry specific foundation materials are need to make work ISO/IEC 17025; the latter document tries to be all things to all men - ISO/IEC 17025 is used by many industries from chemical production, metals, drugs, fertilisers through to food products etc. People may passionately argue it is the right standard to follow. ISO/IEC 17025 is a commercially orientated document for business. It outlines what is expected to get business but not how to go about achieving the results it defines should be met. Achieving the result requires specific i) competencies ii) knowledge iii) skillsets and iv) experiences which are not defined when simply applying over-arching generic principles.
2) A document that should be replaced is the "Association of Chief Police Officers (ACPO) Principles (ACPO, 2012)". There should be in its place an industry document for digital forensic principles similar to the US NIST documents. This document should be for all and created by all and not created by public servants. Just because a document is not 'authorised' as the de facto standard doesn't mean to say it isn't being used in that way to ensure public funds are misguidedly placed in only certain sectors. This means an industry document would apply to everyone following the same criteria set by a 'body' as opposed to "don't do what we do, do what we say" brigade.
3) There needs to be a body such as National Digital Science and Justice Office (NDSJO) that is not run by public or private cronies or apparatchik but by an elected office with elections every five years and no employment-for-life positions. It is important that at least one Active or Retired Senior Judge should be elected to post responsible for safeguarding independence, objectivity and impartiality and with the legal authority to enforce that. 3.1) The NDSJO shall avoid discrimination of any sort and the NDSJO to publish lists of those engaged by the NDSJO measured against criterion such as "age", "sex", "ethnicity" etc. and identify and put deterrents in place to prevent favour to one particular group of persons or political pressures. 3.2) The NDSJO to feed knowledge into national schools, academies, and colleges science education system for the future development of our children. 3.3) The NDSJO shall also provide for a membership and membership fee to ensure wisdom, knowledge, skills and experience thrives within the NDSJO. 3.4) The NDSJO shall work with the Competition Commission etc. to detect and stop cartels or monopolies taking place on public sector contracts. The higher proportion of public sector contracts to go to small and medium sized businesses to help them grow and to avoid large organisations dumping high levels of staff that can undermine the British economy. 3.5) To prevent major contract holders (a) suppressing salaries, wages or self-employed payments and skimming off profits whilst forcing sub-contractors to constantly find savings causing significant detriment to work performance, salaries/wages/self employed payment that when unfettered influence upturn in the British economy. 3.6) The NDSJO shall be responsible for preparing and producing particular digital science industry documents.
4) All manufacturers providing purchased or free tools (software and hardware) to be used for acquiring evidence whether commercial or forensic tools shall be registered with the NDSJO. Manufacturers shall legally self-certify their product as fit for purpose and those who sell tools provide the necessary insurance for all claims. The NDSJO to identify insurance schemes for free tools that have been produced through goodwill but having an effective and affective role when used in acquiring evidence. The latter may equally involve the user of the free tool providing an insurance that might be encapsulated as part of the membership fee of the NDSJO.
...is it true that someone is smiling on the plans above? Well it could act as a needed fillip to the British economy.
There were some good responses from forum members. Those responses combined with the initial enquiry and the download reference document suggested to me that keep tinkering here and there with different elements in "digital forensics" is perhaps why there is no real substantive change consolidating "digital forensics". There is a desire to galvanise a unifying system but as digital forensics is made up of so many constituent elements it maybe quite difficult to know where to start.
Some observations:
1) Industry specific foundation materials are need to make work ISO/IEC 17025; the latter document tries to be all things to all men - ISO/IEC 17025 is used by many industries from chemical production, metals, drugs, fertilisers through to food products etc. People may passionately argue it is the right standard to follow. ISO/IEC 17025 is a commercially orientated document for business. It outlines what is expected to get business but not how to go about achieving the results it defines should be met. Achieving the result requires specific i) competencies ii) knowledge iii) skillsets and iv) experiences which are not defined when simply applying over-arching generic principles.
2) A document that should be replaced is the "Association of Chief Police Officers (ACPO) Principles (ACPO, 2012)". There should be in its place an industry document for digital forensic principles similar to the US NIST documents. This document should be for all and created by all and not created by public servants. Just because a document is not 'authorised' as the de facto standard doesn't mean to say it isn't being used in that way to ensure public funds are misguidedly placed in only certain sectors. This means an industry document would apply to everyone following the same criteria set by a 'body' as opposed to "don't do what we do, do what we say" brigade.
3) There needs to be a body such as National Digital Science and Justice Office (NDSJO) that is not run by public or private cronies or apparatchik but by an elected office with elections every five years and no employment-for-life positions. It is important that at least one Active or Retired Senior Judge should be elected to post responsible for safeguarding independence, objectivity and impartiality and with the legal authority to enforce that. 3.1) The NDSJO shall avoid discrimination of any sort and the NDSJO to publish lists of those engaged by the NDSJO measured against criterion such as "age", "sex", "ethnicity" etc. and identify and put deterrents in place to prevent favour to one particular group of persons or political pressures. 3.2) The NDSJO to feed knowledge into national schools, academies, and colleges science education system for the future development of our children. 3.3) The NDSJO shall also provide for a membership and membership fee to ensure wisdom, knowledge, skills and experience thrives within the NDSJO. 3.4) The NDSJO shall work with the Competition Commission etc. to detect and stop cartels or monopolies taking place on public sector contracts. The higher proportion of public sector contracts to go to small and medium sized businesses to help them grow and to avoid large organisations dumping high levels of staff that can undermine the British economy. 3.5) To prevent major contract holders (a) suppressing salaries, wages or self-employed payments and skimming off profits whilst forcing sub-contractors to constantly find savings causing significant detriment to work performance, salaries/wages/self employed payment that when unfettered influence upturn in the British economy. 3.6) The NDSJO shall be responsible for preparing and producing particular digital science industry documents.
4) All manufacturers providing purchased or free tools (software and hardware) to be used for acquiring evidence whether commercial or forensic tools shall be registered with the NDSJO. Manufacturers shall legally self-certify their product as fit for purpose and those who sell tools provide the necessary insurance for all claims. The NDSJO to identify insurance schemes for free tools that have been produced through goodwill but having an effective and affective role when used in acquiring evidence. The latter may equally involve the user of the free tool providing an insurance that might be encapsulated as part of the membership fee of the NDSJO.
...is it true that someone is smiling on the plans above? Well it could act as a needed fillip to the British economy.
Sunday, July 05, 2015
USB2USB File Management
Now here is a brilliant design highly lauded by the design media back in 2012/2013 that for some reason has yet to see the light of day. Which is a pity really as this has the potential to provide the answer to a number of student final year project ideas. For instance:
[Idea by Kkie21] "I was thinking about writing a program that would be put onto a USB stick and then once connected to a android device it will forensically image it. Everything will be placed on the USB stick which will be write protected once the data is copied."
There had been the suggestion that a USB stick has no screen thus making it difficult to see any form of displayed comparison between DUT storage device and recording device transferred data etc.
I had suggested "Before you give up on your idea, are you are willing to compromise on your physical device?
ChipDrive from Towitoko has previously been used for mobile SIM Card reading. Maybe check with the company to see if they have a USB version. If so then this would be a GUI sufficient to display commands, icons and/or progress indicator. Also there are control keys around the edge that could be used for stop/start etc.
As mentioned above, this device has been used previously and programmed for reading and writing in fields other than time keeping and SIM card reading.
Have a look and see whether it meets your 13-weeks project management schedule.
http://www.chipdrive.de/index.php/en/smart-card-solutions/time-tracking-solutions/chipdrive-time-recording-kit.htm"
However, when I look at this prototype design below and the ability of USB2USB to connect with varying interfaces, user navigation buttons and screen etc etc could make this product, subject to spec, suitable for the above project idea. I really like the design of this product.
- 3 millimeters thick
- fits easily into your wallet
- equipped with an OLED touchscreen
- SD card slot
- 2 USB connectors.
[*Yankodesign said] This device reads most popular types of external memory cards and flash drives. Users only need to plug in the external cards or flashdrives to view the files and folders. Then they can browse the contents of the USB flashdrive and a preview of the selected file will be displayed on the background of the touchscreen display. The files can be transferred or copied by using its drag-and-drop function. The USB connectors, which come with flexible rubberized wires that integrate with the shape of the device, are detachable when in use. This device can be charged directly using the USB connector.
Designers: Saharudin Busri, Mohd Nizam Najmuddin, Mohd Rohaizam Mohd Tahar, Nuzairi Yasin, Nazjimee Amat Omar - MIMOS Berhad http://www.mimos.my/
*http://www.yankodesign.com/2013/01/02/usb-2-usb-and-more%E2%80%A6/
[Idea by Kkie21] "I was thinking about writing a program that would be put onto a USB stick and then once connected to a android device it will forensically image it. Everything will be placed on the USB stick which will be write protected once the data is copied."
There had been the suggestion that a USB stick has no screen thus making it difficult to see any form of displayed comparison between DUT storage device and recording device transferred data etc.
I had suggested "Before you give up on your idea, are you are willing to compromise on your physical device?
ChipDrive from Towitoko has previously been used for mobile SIM Card reading. Maybe check with the company to see if they have a USB version. If so then this would be a GUI sufficient to display commands, icons and/or progress indicator. Also there are control keys around the edge that could be used for stop/start etc.
As mentioned above, this device has been used previously and programmed for reading and writing in fields other than time keeping and SIM card reading.
Have a look and see whether it meets your 13-weeks project management schedule.
http://www.chipdrive.de/index.php/en/smart-card-solutions/time-tracking-solutions/chipdrive-time-recording-kit.htm"
However, when I look at this prototype design below and the ability of USB2USB to connect with varying interfaces, user navigation buttons and screen etc etc could make this product, subject to spec, suitable for the above project idea. I really like the design of this product.
- 3 millimeters thick
- fits easily into your wallet
- equipped with an OLED touchscreen
- SD card slot
- 2 USB connectors.
[*Yankodesign said] This device reads most popular types of external memory cards and flash drives. Users only need to plug in the external cards or flashdrives to view the files and folders. Then they can browse the contents of the USB flashdrive and a preview of the selected file will be displayed on the background of the touchscreen display. The files can be transferred or copied by using its drag-and-drop function. The USB connectors, which come with flexible rubberized wires that integrate with the shape of the device, are detachable when in use. This device can be charged directly using the USB connector.
Designers: Saharudin Busri, Mohd Nizam Najmuddin, Mohd Rohaizam Mohd Tahar, Nuzairi Yasin, Nazjimee Amat Omar - MIMOS Berhad http://www.mimos.my/
*http://www.yankodesign.com/2013/01/02/usb-2-usb-and-more%E2%80%A6/
Sunday, June 14, 2015
Android Copy and Paste - what risks?
This discussion may be relevant and useful to the process of evidence
gathering, eDiscovery investigations and examiner procedures. Experienced
examiners or investigators, new to industry or students that may be unaware of
this subject matter.
Key Classes
COPY AND PASTE
The manual examination test applied: select a new, blank SMS test message page and apply continued finger pressure to the text message field. The DUT vibrates and the dialogue box offers two options: PASTE or CLIPBOARD (see image below). Select CLIPBOARD.
The DUT responds with multiple choice of previously copied data that may be reused. The first entry box is a copy message from the Samsung SMS text message application. The copied data with a stated date and time stamp in the fourth entry box is data copied from a message in WhatsApp.
The Android clipboard-based framework (Android Content Provider)
enables copy and paste directly to and from the clipboard not only of simple
text but also complex data structures, text and binary stream data and application
assets.
Key Classes
- ClipboardManager
- ClipData
- ClipData.Item
- ClipDescription
- Uri
- ContentProvider
- Intent
This content provider enables the distribution of objects stored on the clipboard to be distributed among user applications subject to the permission granted for copying and pasting outside of a particular application.
The practical application for using clipboard copy and paste
might be generally understood by smartphone users but the less experienced
smartphone user may not know or realise that items stored on the clipboard may
still reside in memory on particular smartphones long after the paste function
was used. The same might also apply to examiners relying on extracted and
harvested data from a DUT (device under test) using a particular examination
tool of choice. The tool may not logically recover clipboard objects. Moreover,
the copied data may not be distinguishable from a deleted SMS message when
carving data from a physical extracted dump (JTAG/chip off), so checking the clipboard identifies is important.
Conduct a test on a smartphone of your choice. Tests run on
a random number of makes/models not all were found to allow revisiting pasted
data from previous copying, not all allowed data copied in one application
(e.g. WhatsApp) to be made available to another (e.g. text messaging). Thus,
manual examination might need to be applied during an examination process in
order to determine during discovery any vital data (evidence) excluded during a
tool’s recovery procedure.
As there are variances between makes/models it equally
raises concerns of any missed opportunities to recover data during past
examination.
DUT – Samsung GT-I9100P
COPY AND PASTE
The manual examination test applied: select a new, blank SMS test message page and apply continued finger pressure to the text message field. The DUT vibrates and the dialogue box offers two options: PASTE or CLIPBOARD (see image below). Select CLIPBOARD.
The DUT responds with multiple choice of previously copied data that may be reused. The first entry box is a copy message from the Samsung SMS text message application. The copied data with a stated date and time stamp in the fourth entry box is data copied from a message in WhatsApp.
Note the format change of the date and the clock is out by
one minute, when cross-referenced to the WhatsApp image below. Is this down conversion from one application to another? Are there two clocks being used on the same
smartphone? Was the SMS message created first and copied and pasted into WhatsApp? Or is it something
else?
Further issues to be considered. Subject to the matter as
mentioned above regarding permission granted to copy and paste outside of a
particular application; Android in itself does not require any permission to be
entered to write data to or read data from the clipboard. Consequently, this can
leave a security loophole in place where an application requires a user to copy their credentials
(passwords, PINs etc.) first before the user may make use of an application.
Moreover, the android.content.ClipboardManager.OnPrimaryClipChangedListener
is an interface within Android SDK enabling listener call-back that is invoked each
time a clipboard item changes. A change in password, PIN etc updated by a
particular application could update the clipboard previously stored data. This
could be problematical by causing a breach in security if malware were to be
unintentionally installed to the smartphone and then credentials leaked to an outside source. The smartphone security for copy and paste therefore can only be
as good as the permission granted within the applications being installed and
used.
Observations. When making analysis of security an examiner/investigator simply referring
to the latest makes/models of smartphones or apps on the market may well be flawed in
using that analytical approach. There are a considerable number of handsets out
there which are in use on a day-to-day basis for work and personal activity.
These can be e.g. 5yrs to 10yrs old. Operators are currently offering an
alternative to subsidised handsets by offering SIM ONLY contracts. The smartphone
won’t be updated. Companies may well fail in their fiduciary responsibilities
and duty of care at board level owed to the company to offload natural company
expenditure by avoiding providing communication devices to company employees. To
foster the notion to employees to BYOD (bring your own device) the employee is in fact playing
a part in subsidising a company’s communications system and therefore its security; retains the
opportunity for security loopholes to be created by employers assuming that smartphone users know everything about their smartphone, which is a fallacy.
Sunday, June 07, 2015
Metrology - USB part 1
With smartphones, tablets and other devices fitting the description Size-Scaled Digital Technology (SSDT) using USB physical connectivity provides for the simplest of examination DUT illustrations e.g the combination of three separate entities involved in inter-connection during an examination.
1) DUT (the target device (SSDT) containing suspected evidence
2) The physical medium (USB) to carry the source data to the examination tool
3) The examination tool (ET) used to extract and harvest evidence
It is possible to extrapolate even greater numbers of inter-connected entities but then it would be simpler, if I were to do that, to simply write a book instead of writing this blog post. Moreover, greater numbers of inter-connections exponentially introduce the potential for higher risk of failure relevant to an entity's MTBF (mean time between failure) and MTTF (mean time to failure).
[”British scientist, Sir William Thomson (Lord Kelvin, 1824 - 1907),
concisely captured the aspect of knowledge so that others can study
the observations and apply the results without having to repeat the
experiment, when he wrote: “When you can measure what you are
speaking about and express it in numbers, you know what you are
talking about.”]
SSDT - USB - ET provides a useful basis upon which to consider metrological traceability:
"A core concept in metrology is metrological traceability,[7] defined by the Joint Committee for Guides in Metrology as "property of a measurement result whereby the result can be related to a reference through a documented unbroken chain of calibrations, each contributing to the measurement uncertainty".[8] Metrological traceability permits comparison of measurements, whether the result is compared to the previous result in the same laboratory, a measurement result a year ago, or to the result of a measurement performed anywhere else in the world."
http://en.wikipedia.org/wiki/Metrology#Metrological_traceability
An excellent source of reference for definitions for the science of measurement is:
International vocabulary of metrology — Basic and general concepts and associated terms (VIM)
Vocabulaire international de métrologie — Concepts fondamentaux et généraux et termes associés (VIM)
http://www.bipm.org/utils/common/documents/jcgm/JCGM_200_2008.pdf
International vocabulary of metrology – Basic and general concepts and associated terms (VIM) 3rd edition (2008 version with minor corrections)
Vocabulaire international de métrologie – Concepts fondamentaux et généraux et termes associés (VIM)
3e édition (Version 2008 avec corrections mineures).
http://www.bipm.org/utils/common/documents/jcgm/JCGM_200_2012.pdf
Why have I shown two versions of the same document? Traceability is the answer. Building a quality system requires identification of reference materials upon which test measurements are (or have been in the past) conducted. Anyone involved in lab preparation and of running a lab should be aware that standards iso17025 and iso9001 identify principles that may be adopted for a wide range of industries etc. It is only when drilling down into how these principles should be applied in practice does one become aware of how, metaphorically speaking, naked one is without something or someone else pointing to a path to follow.
VIM is an acknowledged and established international standard that can be referenced for defining the naming conventions for testing. Of course, there is still the need for knowledge, skill and experience for operating under lab conditions. Early works of Scroggie and Johnstone even today provide useful observations about various aspects of testing involved in a laboratory environment can be found in Radio and Electronic Laboratory Handbook 1980 edition (Marcus Graham Scroggie and George Gordon Johnstone ISBN 0-408-00373-1 and ISBN 13: 9780408003735). The book is available from Amazon and from reputable booksellers.
There are a range of other reference materials from testing through to calibration. For instance NASA (Deep Space Network) http://deepspace.jpl.nasa.gov/dsndocs/810-005/214/214-1.pdf ; Laboratories for the Design and Assembly of Electronic Devices using Surface Mount Components conferencepaper.pdf ; Handbook of Laboratory Experiments in Electrical and Electronics Vol.3 (Adamu Murtala Zungeru; James G. Ambafi ISBN 9781497507203) ; and the list goes on. These reference materials are in addition to publications produced by the FBI, NIST, ACPO etc...
This discussion started out by referring to the physical medium USB to carry the source data from the DUT to the examination tool (ET). The relevance of doing so is that if the examiner eliminates the medium as the cause for failure or corrupted evidence then the logical conundrum that remains, is the DUT can be at fault, is the ET can be at fault or are both DUT/ET together faulty?
To understand the technical properties for USB look here:
USB Type C
http://www.usb.org/developers/usbtypec/
http://www.usb.org/developers/docs/
http://www.usb.org/developers/docs/usb_31_060115.zip
This version of USB specification is identified, not simply from personal experience, but due to industry adoption of the standard:
(a) http://www.usb.org/press/USB_Type-C_Specification_Announcement_Final.pdf
(b) http://arstechnica.com/gadgets/2014/08/small-reversible-usb-type-c-connector-finalized/
Image credited to http://arstechnica.com/gadgets/2014/08/small-reversible-usb-type-c-connector-finalized/
(c) https://support.apple.com/en-gb/HT204360 etc...
A testing schedule for MTBF and MTTF cannot be created unless the device class using a version of the USB specifications is corroborated:
Device Classes (some useful resource materials)
http://www.usb.org/developers/docs/devclass_docs/
http://www.atmel.com/dyn/resources/prod_documents/doc4322.pdf
http://www.linux-usb.org/usbnet/
http://cscott.net/usb_dev/data/devclass/usbcdc11.pdf
Moreover, if USB 3.0 is backward compatible with USB 2.0 could USB 3.0 be used as the de facto standard for all SSDTs to assist defining MTBF and MTTF?
What about USB plug/port sizes, would these create different test requirements?
Lastly, and to close Part 1 of this blog discussion, there is another question equally worth asking: "Does a manufacturer's/supplier's warranty for 12 or 24 months mean that lab testing is not necessary for that period of the warranty in question?
Previous discussion under Metrology
http://trewmte.blogspot.co.uk/2015/05/metrology.html
Knowing DUT memory
http://trewmte.blogspot.co.uk/2015/05/knowing-dut-memory.html
1) DUT (the target device (SSDT) containing suspected evidence
2) The physical medium (USB) to carry the source data to the examination tool
3) The examination tool (ET) used to extract and harvest evidence
It is possible to extrapolate even greater numbers of inter-connected entities but then it would be simpler, if I were to do that, to simply write a book instead of writing this blog post. Moreover, greater numbers of inter-connections exponentially introduce the potential for higher risk of failure relevant to an entity's MTBF (mean time between failure) and MTTF (mean time to failure).
[”British scientist, Sir William Thomson (Lord Kelvin, 1824 - 1907),
concisely captured the aspect of knowledge so that others can study
the observations and apply the results without having to repeat the
experiment, when he wrote: “When you can measure what you are
speaking about and express it in numbers, you know what you are
talking about.”]
SSDT - USB - ET provides a useful basis upon which to consider metrological traceability:
"A core concept in metrology is metrological traceability,[7] defined by the Joint Committee for Guides in Metrology as "property of a measurement result whereby the result can be related to a reference through a documented unbroken chain of calibrations, each contributing to the measurement uncertainty".[8] Metrological traceability permits comparison of measurements, whether the result is compared to the previous result in the same laboratory, a measurement result a year ago, or to the result of a measurement performed anywhere else in the world."
http://en.wikipedia.org/wiki/Metrology#Metrological_traceability
An excellent source of reference for definitions for the science of measurement is:
International vocabulary of metrology — Basic and general concepts and associated terms (VIM)
Vocabulaire international de métrologie — Concepts fondamentaux et généraux et termes associés (VIM)
http://www.bipm.org/utils/common/documents/jcgm/JCGM_200_2008.pdf
International vocabulary of metrology – Basic and general concepts and associated terms (VIM) 3rd edition (2008 version with minor corrections)
Vocabulaire international de métrologie – Concepts fondamentaux et généraux et termes associés (VIM)
3e édition (Version 2008 avec corrections mineures).
http://www.bipm.org/utils/common/documents/jcgm/JCGM_200_2012.pdf
Why have I shown two versions of the same document? Traceability is the answer. Building a quality system requires identification of reference materials upon which test measurements are (or have been in the past) conducted. Anyone involved in lab preparation and of running a lab should be aware that standards iso17025 and iso9001 identify principles that may be adopted for a wide range of industries etc. It is only when drilling down into how these principles should be applied in practice does one become aware of how, metaphorically speaking, naked one is without something or someone else pointing to a path to follow.
VIM is an acknowledged and established international standard that can be referenced for defining the naming conventions for testing. Of course, there is still the need for knowledge, skill and experience for operating under lab conditions. Early works of Scroggie and Johnstone even today provide useful observations about various aspects of testing involved in a laboratory environment can be found in Radio and Electronic Laboratory Handbook 1980 edition (Marcus Graham Scroggie and George Gordon Johnstone ISBN 0-408-00373-1 and ISBN 13: 9780408003735). The book is available from Amazon and from reputable booksellers.
There are a range of other reference materials from testing through to calibration. For instance NASA (Deep Space Network) http://deepspace.jpl.nasa.gov/dsndocs/810-005/214/214-1.pdf ; Laboratories for the Design and Assembly of Electronic Devices using Surface Mount Components conferencepaper.pdf ; Handbook of Laboratory Experiments in Electrical and Electronics Vol.3 (Adamu Murtala Zungeru; James G. Ambafi ISBN 9781497507203) ; and the list goes on. These reference materials are in addition to publications produced by the FBI, NIST, ACPO etc...
This discussion started out by referring to the physical medium USB to carry the source data from the DUT to the examination tool (ET). The relevance of doing so is that if the examiner eliminates the medium as the cause for failure or corrupted evidence then the logical conundrum that remains, is the DUT can be at fault, is the ET can be at fault or are both DUT/ET together faulty?
To understand the technical properties for USB look here:
USB Type C
http://www.usb.org/developers/usbtypec/
http://www.usb.org/developers/docs/
http://www.usb.org/developers/docs/usb_31_060115.zip
This version of USB specification is identified, not simply from personal experience, but due to industry adoption of the standard:
(a) http://www.usb.org/press/USB_Type-C_Specification_Announcement_Final.pdf
(b) http://arstechnica.com/gadgets/2014/08/small-reversible-usb-type-c-connector-finalized/
Image credited to http://arstechnica.com/gadgets/2014/08/small-reversible-usb-type-c-connector-finalized/
(c) https://support.apple.com/en-gb/HT204360 etc...
A testing schedule for MTBF and MTTF cannot be created unless the device class using a version of the USB specifications is corroborated:
Device Classes (some useful resource materials)
http://www.usb.org/developers/docs/devclass_docs/
http://www.atmel.com/dyn/resources/prod_documents/doc4322.pdf
http://www.linux-usb.org/usbnet/
http://cscott.net/usb_dev/data/devclass/usbcdc11.pdf
Moreover, if USB 3.0 is backward compatible with USB 2.0 could USB 3.0 be used as the de facto standard for all SSDTs to assist defining MTBF and MTTF?
What about USB plug/port sizes, would these create different test requirements?
Lastly, and to close Part 1 of this blog discussion, there is another question equally worth asking: "Does a manufacturer's/supplier's warranty for 12 or 24 months mean that lab testing is not necessary for that period of the warranty in question?
Previous discussion under Metrology
http://trewmte.blogspot.co.uk/2015/05/metrology.html
Knowing DUT memory
http://trewmte.blogspot.co.uk/2015/05/knowing-dut-memory.html
Subscribe to:
Posts (Atom)