PNNL

Abstract

In this paper, the authors propose a modification of CERT's 3 R model to include a 4 th R, the discipline of Redress, identified as a necessary step to end the hacker arms race. Redress will require implementation of computer forensic investigation methods, tools and techniques that will permit evidence gathered to be admissible in a court of law, a standard not often understood or followed by many who are responsible for securing networks today. This leads the authors to conclude that there is a need for future work that will involve re-examination of the mechanisms and procedures used to collect evidence of network intrusions in order to ensure that the Rules of Evidence requirements are considered.