The rantings of Craig Chapman, Computer Forensics Geek.

Lest Big Galoot be accused of souding too flippant at the undeniable benefits of “Standards” in our lives, let’s not forget an often overlooked human side of the increasing “Standardisation” of our world and those who feel the irrepressible urge to write them.

Standards make many people happy, warm and comfortable as does a nice pair of fluffy slippers and a cup of warm cocoa. This is not necessarily a bad thing. I like my cocoa and slippers as much as the next bloke. But make no mistake, standards are sometimes touted by those who feel an overwhelming need to compartmentalise theirs and other peoples lives by standardising the way in which everyone does things.

For those mother hens of the world who seem to take pleasure in writing procedures & processes for everything we do – from walking our dog off its leash in the park, to spitting on a footpath, is it more a case of process – at the expense of performance?

A recent article at CIO mag http://www.cio.com.au/index.php/id;1626336618;fp;4;fpid;51238 proposes that new network forensics standards are “crucial to the speed and fairness of the US judicial system.”

What a complete load of puffed-up, breast-beating, piffle! The irony is, they’re likely to achieve the opposite effect, resulting in a lower conviction rate and slower trials due to forensics people being simply unable to comply with every little nuance laid down by unworkable standards written erroneously to cover every conceivable network crime scene. Which of course, they can’t. Hence my point.

So what about that term, “Standard”? By virtue of the word, it comes attached with an inference of a way in which things ought to be done, given a certain circumstance. But that’s the problem. Is every network
architecture the same? Is every botnet, Phishing or DDOS attack the same? Does every hacker deploy the same methods?

Attempts to further standardise the way in which all of these matters are forensically investigated, in addition to the already universally accepted, existing digital evidence handling and crime scene procedures, would be a ridiculously cumbersome, onerous and overly ambitious proposition. Worse
still, in order to keep up with the evolving nature of networks and e-crimes, those standards would need to be re-written on a daily basis.

So whats the difference between standard computer forensics evidence handling methodology or any other crime scene, evidence handling process? Not much. The overriding principles of evidence preservation remain the same, no matter if its a murder investigation or a botnet attack. Which is why there’s no need for such additional red-taped standards.

So instead of trying to impose additional standards upon the computer forensics profession, what’s needed is recognition by the “standardisers” of the world, (you know who you are) of the enormously liquid, complex and constantly evolving nature of networks and the inherent need for network-based forensics to be adaptable to every scenario, now and in the future.

But if they simply must write yet another boring, red-tape standard (read -rule\law), here’s a thought: Please, will someone write a standard – to those annoying and foul smelling, IPOD-wearing, greasy haired gits who catch my train at 6.30am every morning – who pretend they can’t be heard – banning their 1000dB mp3 techno-funk, noise pollution? I just want to read my morning paper in peace. Surely, that’s a far more noble and worthy “standard”?!

Big Galoot