Digital Forensics Curriculum in Security Education

Information Security curricula usually cover traditional security topics such as network security, cryptography, and operating system security. As individuals and businesses have come to rely more heavily on computing technology, criminals also have turned their attention to such technology. Consequently, security requires developing adequate policies to protect the information assets, as well as gathering suitable evidence in case the matter ends in a court. Rapid advancements in storage technology have contributed to storing large volumes of data in small devices. Such devices could be hidden with criminal intent or are prone to being lost, thus exposing confidential information. In either case, we need to expose the students specializing in security education to both the technology and the legal aspects. The author had the benefit of working closely with Information Security educators in the nation as part of the National Security Agency effort to develop curriculum that will address the security needs of the United States. In this regard the author developed a course in Digital Forensics as part of an Information Security Curriculum. When presentations were made in regional conferences about these efforts, the author found out that there was faculty in other institutions who were interested in starting a similar course in their institutions. They were also faced with similar financial challenges in developing a dedicated lab for Digital Forensics. Having taught this course twice, the author had ferreted out and obtained many inexpensive software packages to support the digital forensics curriculum. In this paper, the author will share a sample undergraduate curriculum, resources needed to develop an inexpensive digital forensics lab, and steps to integrate this course in the InfoSec curriculum. As a motivation for this approach, first a brief history of Digital Forensics investigative history around the world is presented. This discussion identifies the major organizations that have contributed to the development of the necessary standards. The section on curriculum lays out the core learning objectives and the course content needed to cover these objectives. This is followed by details on setting up a Digital Forensics Laboratory. In this section, the author points out the usefulness of collecting hard drives from old computers and also the need to have several old computers available for teaching about the hardware elements. The section on Resources lists numerous free software resources as well as the ability to obtain commercial grade software from Access Data Corporation for free for instructional purposes. One of the key requirements in a digital forensics investigation is safe handling of evidence. This aspect is emphasized in detail about the Chain of Custody for data and presentation of evidence analysis to a court of law. The paper is concluded with lessons learned as well as what the next steps would be for future enhancements.