基植管理循環為基礎之社交工程事件鑑識分析研究

Applying an Iterative PDCA Management Process to the Forensic Analysis of Social Engineering Technique

高大宇(Da-Yu Kao) ； 曾俊傑(Jyun-Jim Zeng) ； 王旭正(Shiuh-Jeng Wang)

《前瞻科技與管理》 1卷1期 (2011/05) Pp. 85-98

摘要

許多資訊駭客沈浸於靜悄悄地入侵電腦系統，意圖竊取資料、破壞資訊隱私。資安事件調查的紀錄檔案是追查事件來源的最初指標，驗證稽核紀錄的可信度為評斷是非或論罪科刑的重要參考依據。本文透過計畫(Plan)、執行(Do)、檢查(Check)及行動(Act)等管理循環，從「被動資安防護」、「主動滲透測試」、「逆向追查紀錄」、「對象查訪驗證」及「使用習慣養成」等5面向檢討社交工程的資安演練事件。本文不僅歸納一些追蹤犯罪者的指引作法，也展示避免犯下錯誤結論的發現事實作法。藉由本文研究，處理資安事件的反應者，將能夠採用有效分析稽核紀錄的策略，降低資安鑑識事件過程的不當處置作為。

關鍵字

數位證據 ； 無罪推定 ； 紀錄分析 ； 管理循環 ； 社交工程

並列摘要

Dozens of hackers are dedicated to silently invading computer system. They are making efforts directed toward destroying computer privacy and data. The auditing log is the initial source of tracing information security. To explore the fact, verifying reliability of related auditing record becomes an essential part of judging right from wrong. This paper proposes an iterative Plan-Do-Check-Act (PDCA) management process against external data intrusion incidents. A Social Engineering drill of 5-phase testing analysis is exhibited to strengthen computer defense system: Passive Data Security Protection, Proactive Penetration Testing, Reverse Record Tracking, Target Verification and User Habits. It not only summarizes some active follow-up guidelines to trace offenders but also demonstrates an accurate fact finding to prevent from erroneous conclusions. In response to the study in Social Engineering, the incident responders can have effective strategies of analyzing auditing record and reduce the possibilities of judicial misconduct in the forensic analysis of cybercrime event.

並列關鍵字

digital evidence ； presumption of innocence ； log analysis ； PDCA ； social engineering

參考文獻

Kak A, April 9, 2010, "Mounting Targeted Attacks with Trojans and Social Engineering - Cyber Espionage," Lecture Notes on Computer and Network Security, (accessed October 10, 2010)

Akhter, F.(2008).E-Commerce Security: The Categorical Role of Computers in Forensic Online Crime.2008 IEEE The First International Workshop on Multimedia (MPIS-08).(2008 IEEE The First International Workshop on Multimedia (MPIS-08)).:

Blunden, B.(2009).The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System.Plano, TX, US:Wordware.

Carvey, H.(2009).Windows Forensic Analysis DVD Toolkit.Burlington, VT, US:Syngress.

Casey, E.(2009).Handbook of Digital Forensics and Investigation.Burlington, VT, US:Academic Press.