Abstract:
Computers play a vital role in the automation of tedious tasks in our everyday lives.
With the adoption of the advances in technology, there is a significant increase in
the exploitation of security vulnerabilities, particularly in Windows computing
environments. These exploitations are mostly carried out by malicious software
(malware). Ransomware, a variant of malware which encrypts user files and retains
the decryption key for ransom. Ransomware has shown its dominance over the
years wreaking havoc to many organizations and users. This global digital epidemic
is continuously on the rise with no signs of being eradicated. The current method of
mitigation and propagation of malware and its variants, such as anti-viruses, have
proven ineffective against most ransomware attacks. Theoretically, Ransomware
retains footprints of the attack process in the Windows Registry as well as volatile
memory of the infected machine. With the adoption of Digital Forensic Readiness
(DFR) processes organizations can better prepare for these types of attacks. DFR
provides mechanisms for pro-active collection of digital artifacts. These artifacts play
a vital role when a digital investigation is conducted where these artifacts may not
be available post-incident. The availability of such artifacts can be attributed to the
anti-forensic properties of the ransomware itself cleaning up all the evidence before
it can be investigated. Ransomware investigation often to a lengthy process
because security researchers need to disassemble and reverse engineer the
ransomware in order to find a inherit flaw in the malware. In some cases, the
ransomware is not available post-incident which makes it more difficult. Therefore,
study proposed a framework with the integration of DFR mechanisms as a process
to mitigate ransomware attacks whilst maximizing Potential Digital Evidence (PDE)
collection. The proposed framework was evaluated in compliance with the ISO/IEC
27043 standard as well as expert review using two prototype tools. These prototype
tools realize the framework by providing a proof of concept implementation of such
a framework within an organization. The evaluation revealed that the proposed
framework has the potential to harness system information prior to, and during a
ransomware attack. This information can then be used to help forensic investigators
to potentially decrypt the encrypted machine, as well as providing automated
analysis of the ransomware relieving the burden of complicated analysis. The
implementation of the proposed framework can potentially be a major breakthrough
in mitigating this global digital endemic that has plagued various organizations.
