Forensic Disk Copying for Targeted Cybersecurity Remediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing forensic analysis in cloud computing environments is resource-intensive and disruptive to normal operations, as it often involves unnecessary disk access when breaches are suspected but not confirmed.
Innovation Solution
The generation of an inspectable disk based on the original disk in the computing environment, allowing forensic analysis without disturbing the original disk, and initiating remediation actions only when cybersecurity threats are confirmed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If forensic analysis is performed on the original disk, then cybersecurity breaches can be detected, but normal operations are disrupted and resources are consumed
Solution Approach 1:
The patent creates a forensic copy of the original disk that can be analyzed independently. This copy serves as a duplicate that preserves all data and structure of the source disk, allowing forensic software to perform comprehensive analysis without accessing or interfering with the original disk's operations. The forensic copy is mounted in a way that prevents write operations to the source, ensuring operational continuity.
Solution Approach 2:
The patent introduces a forensic copy as an intermediary layer between the forensic analysis process and the original disk. This intermediary absorbs the impact of forensic operations, allowing detection activities to proceed while the original disk remains unaffected. The forensic copy acts as a buffer that mediates between the need for thorough analysis and the need to maintain normal system operations.
2Reliability
If forensic analysis software is deployed, then cybersecurity risks can be identified, but system resources are consumed
Solution Approach 1:
By analyzing a forensic copy rather than the original disk, the system enables comprehensive security scanning without the resource overhead of analyzing live systems. The forensic copy can be processed offline or in a controlled environment, separating the resource-intensive analysis workload from the production system's resource consumption.
Solution Approach 2:
The patent applies forensic analysis selectively based on detected indicators of compromise. Rather than continuously analyzing all disks, the system monitors for specific forensic artifacts and only initiates full forensic analysis when suspicious patterns are detected, thereby optimizing resource utilization while maintaining security detection capability.
3Reliability
If disk access operations are devoted to forensic analysis, then breaches can be confirmed, but analysis may be performed on non-compromised disks
Solution Approach 1:
The system performs preliminary monitoring for forensic artifacts and indicators of compromise before initiating full forensic analysis. This preliminary detection phase allows the system to identify suspicious patterns and target only those disks that show signs of potential compromise, avoiding the time-consuming process of analyzing every disk in the system.
Solution Approach 2:
The system implements a feedback mechanism where forensic analysis results inform subsequent monitoring and analysis decisions. When forensic artifacts are detected, the system triggers targeted analysis; when no artifacts are found, normal monitoring continues. This feedback loop optimizes resource allocation and reduces unnecessary analysis time by focusing efforts on high-risk targets.
Data Source
AI summary
A system and method for iterative cybersecurity remediation based on a digital forensic finding is disclosed. In an embodiment, the method includes detecting a forensic finding, the forensic finding based on a forensic artifact detected on a disk of a resource in a computing environment; generating an inspectable disk based on the disk of the resource; inspecting the inspectable disk for a cybersecurity object based on the forensic artifact; and initiating a remediation action on the disk based on the cybersecurity object detected on the inspectable disk.