Performing remote live response on organizational environment
Joni Ahonen · Theseus (Ammattikorkeakoulujen) · 2020
With the digitalization of society, the traditional crimes have manifested in digital operational environment in cybercrimes, which have created a need for organizations to build a lasting ability to detect and respond to the occurring security incidents. JAMK University of Applied Sciences in association with the Police University College have striven to find means to improve the organizations’ capabilities in a cooperation project named CYBERDI. One result of the project has already been published, namely the conceptual cybercrime prevention model, Prepare – Hunt – Response. The model created by JYVSECTEC’s specialists helps organizations to improve their capability to prepare, detect, and respond to incidents occurring in organizations’ information systems and networks. During the project the model will be supplemented to include a technical environment for cybercrime prevention. Before the technical environment execution, JYVSECTEC being the assignor of the thesis, had the desire to examine the capabilities of two of existing open source remote live response tools, and performance restrictions when utilized for investigation in an organizational environment consisting of hundreds of endpoints. The assignment was set to be the objective of the research. The research was constructed using two different test cases which produced the results of how the tools’ performance. The results verified that the researched tools are capable of gathering data from occurred incident on organizational environment, and usage of the tools in the assignor’s technical environment execution is justifiable. However, the tools require additional expertise when performing intensive investigation as they have similar features. All things considered, the researched tools should still be considered as a combination of two tools and when selected to investigate an organization environment, they should be extending each other, not excluding the other.