Air Force cyber official: need to invest in digital forensics

The go­vern­ment needs to in­vest in di­gi­tal fo­ren­sics to keep pace with in­ci­dents and th­reats in cy­bers­pa­ce, the prin­ci­pal cyber ad­vi­ser for the De­part­ment of the Air Force said Thurs­day.

“In order to de­tect, help us hunt and find where the in­ci­dent star­ted… the di­gi­tal fo­ren­sics, I be­lie­ve we need to do, and focus, and in­vest in that world,” said Wanda Jones-Heath, spea­king at the Da­ta­dog Th­reat Res­pon­se Forum, pro­du­ced by FedS­coop.

The fo­ren­sics role is vital even though “they’re after the fact,” she said.

“They go and look what hap­pe­ned weeks and months after the in­ci­dent has oc­cu­rred, and so I think we need to fi­gu­re out: ‘How do we keep pace with in­ci­dents as they are oc­cu­rring?’” Jones-Heath said. “Once we iden­tify it, then you start loo­king at the fo­ren­sics of what hap­pe­ned, who did it, where they are, where it ori­gi­na­ted from and then how you par­ti­tion the areas that are still under fire while you con­ti­nue to ope­ra­te in that en­vi­ron­ment.”

Jef­frey Hunt, glo­bal ope­ra­tions branch chief for the De­part­ment of De­fen­se Cyber Crime Cen­ter, which pro­vi­des di­gi­tal fo­ren­sic in­ves­ti­ga­tions, said at the same event that the di­vi­de bet­ween ope­ra­tions and se­cu­rity on get­ting vi­si­bi­lity into net­works about th­reats is an issue that needs to be ad­dres­sed early…