Proactively Defending Computing Infrastructures through the Implementation of Live Forensics and Capture in Corporate Network Security

The wide development of the mobile and virtualised technologies in the past decade has further destabilised the already fragile balance between the defenders and the attackers of computing infrastructures. Coupled with the fact that risk is not controlled by the defenders but by the attackers, it makes no sense to try and re-actively defend computing infrastructures. Apropos, in this new socially driven knowledge-based computing era that corporations are asked to operate in, there is a need to pro-actively defend computing infrastructures by attempting to control the source of the threats that they face. In this paper we discuss forensic readiness issues of such a system and we examine how we could ensure and assure evidential integrity and chain of custody of the near real time intelligence that the system would be collecting.