Inspectable Disk Forensics for Low-Disruption Cyber Remediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing forensic analysis in cloud computing environments is resource-intensive and disruptive to normal operations, as it requires accessing disks even when a breach is suspected but not confirmed, leading to unnecessary resource allocation.
Innovation Solution
A method and system for generating an inspectable disk based on the original disk in a computing environment, allowing forensic analysis without disrupting the original disk, using a forensic account to access the inspectable disk for analysis and initiating remediation actions only when cybersecurity threats are confirmed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If forensic analysis is performed directly on the original disk, then detection precision is improved, but the computing environment operation is disrupted and resources are wasted
Solution Approach 1:
The patent creates a copy of the original disk to serve as the inspectable disk. This copy contains the same data and forensic artifacts as the original, allowing forensic analysis to be performed on the copy without disrupting the original disk's normal operations in the computing environment.
Solution Approach 2:
The inspectable disk acts as an intermediary between the forensic analysis software and the original disk. Forensic analysis is performed on this intermediate copy, which mediates the interaction between the analysis tools and the production system, preventing direct disruption to the original disk while still enabling thorough forensic investigation.
2Speed
If forensic analysis resources are allocated proactively, then detection speed is improved, but resource waste increases when no breach exists
Solution Approach 1:
The system proactively generates an inspectable disk copy and prepares it for forensic analysis before a breach is confirmed. This preliminary action ensures that when forensic analysis is needed, the resources are already in place and ready to go, enabling rapid detection without waiting for resource allocation after threat confirmation.
Solution Approach 2:
The system dynamically adjusts resource allocation based on actual breach detection needs. The inspectable disk is created and forensic resources are provisioned on-demand when suspicious activity is detected, rather than maintaining constant forensic analysis resources. This dynamic approach optimizes resource utilization by activating forensic capabilities only when necessary.
Data Source
AI summary
A system and method for initiating cybersecurity remediation based on a digital forensic finding is presented. The method includes detecting a forensic artifact on a disk of a resource in a computing environment; generating an inspectable disk based on the disk of the resource; inspecting the inspectable disk for a cybersecurity object based on the forensic artifact; and initiating a remediation action on the disk based on the cybersecurity object detected on the inspectable disk.