Analyzing the Quality Assurance of Trainees Competency Assessment and Accreditation of Cyber Forensic Education/Training Programs

Transcription

1 Analyzing the Quality Assurance of Trainees Competency Assessment and Accreditation of Cyber Forensic Education/Training Programs Elfadil Sabeil Faculty of Computer Science & Information Systems Johor Baru, Malaysia Azizah Bt Abdul Manaf Advanced Informatics School Kuala Lumpur, Malaysia Zuraini Ismail Advance Informatics School Kuala Lumpur, Malaysia Abstract This paper presents a critical analysis on the trainee s competency assessment (evaluation) quality assurance and accreditation of Cyber forensic programs provided by some training institutions in USA, U.K., Australia and China. It summarizes the existing competency assessment quality assurance based on both internal and external and accreditation for Associate and Diploma Degree Programs, Certificate Programs, Undergraduate Programs and Master/graduate Programs. It briefly highlights factors which should be considered when offering any Cyber forensic training/education program. The result shows that Cyber forensic training/education has inadequate consideration for the competency assessment quality assurance and accreditation. Keywords-component; competency assessment quality assurance; accreditation; internal ; external I. INTRODUCTION In the current era, information and communications technology (ICT) is predominantly part of our life, mostly in a positive way [1]. It is covers many aspect of activities for most of people around the world. In addition, most of people depend on ICT to communicate, transport, produce food, trade, entertain and so forth. The rapid progress and development of computers, networks and communications create ever changing world. However, nowadays most of technologies are prone to criminal activities. In other words, they contribute to various huge Cyber crimes [2]. There are relatively few criminal and civil cases that do not involve computer evidence. A research has estimated of over 85% of criminal and civil prosecution cases have involved digital evidence [3]. These crimes include fraud, hacking identity theft and other illegal activities. Consequently, Cyber crimes have a massive impact on world economies. Studies carried out in USA and UK companies indicate that the financial losses due to cyber crimes are very high [4, 5]. Therefore, several businesses have lost reputation, while violation to individual privacy and even public safety and national security interests are also in rise. Thus, securing information system assets of organizations has also become more complex and highly recommended as computer resources become more vital. Cyber forensic exists as a response to combat crimes committed by leveraging computer utilities either as source of crime, stores of crime s data or facilitating criminal activities. Z. Hamzah [6] defines Cyber forensic as legal aspects of computer investigation and involves the analysis of digital evidence covering the identification, examination, preservation and presentment of potential electronic evidence in a manner that would allow such evidence to be admitted in a court of law. Cyber forensics can play a significant role in computer and network security, information assurance, law enforcement, and national defence [1]. For instance, Cyber forensic investigators (CFIs) play a vital role in contingency planning in business or National Critical Corporations (NCC). This comes due to the fact that both service return and maintaining crime evidence are required when systems are compromised [7]. In addition to that, the task of the CFIs is not only to investigate crimes but it also to teach the laymen when presenting technical testimony terms in court. Therefore, they must have qualifications, skills, experience, education and training in the relevant field in order to meet the investigation requirements [8]. In spite of the fact that the Cyber forensic goes backs to 30 years ago, and new training/education qualifications emerge regularly in some development countries, researchers have found that many countries around the world lack Cyber forensic investigators [9, 10, 11]. The lack of professionalism in Cyber forensic comes due to some factors. For instances, training and education services on Cyber forensics investigation are relatively new. Furthermore, many of the qualifications are presented by vendors and owners of investigation tools. In addition, most of the training/education providers concentrate on the system weakness or training trainees on the use of specific tools or techniques, rather than concentrating on knowledge, skills, ability (KSA) and assessment needs [12]. Moreover, most of them are not verified by independent external examiner and accreditation bodies [13]. In this paper, the authors (Digital Forensics certification holders) contribution is to review the current situation of the Cyber forensic education and training competency assessment quality assurance (internal/external ) /11/$ IEEE V4-346

2 and accreditation [13]; in both academic and non academic institutions. This paper is divided into four sections. The first section introduces the problem behind this paper. Section two presents a critical analysis concerning the accreditation and competency assessment quality assurance in Cyber forensic training/education institutions. In section three, the authors discuss the result of the analysis, and section four summarizes the findings. II. ACCREDITATION AND QUALITY ASSURANCE Quality assurance is a process of assessing quality through both planned and orderly actions in order to show a product/service confidence or specific requirements for quality are met on the service offered [14]. Thus, the Quality assurance systems would minimize the risks inherent in training providers by maintaining the quality of teaching/training and assessment methods carried on training providers. W. Pond [15] states Accreditation as the procedure by which an authoritative body gives formal recognition that a body or person is competent to carry out specific tasks. Accreditation is a header of the quality assurance program that monitors the efforts of management practices, personnel performance, internal and external quality system and procedures exerted to meet national and/or international standards [14]. Accreditation has many benefits, including:- Validation and external value assurance. Encourages students/trainees to select a program. Proves the quality of the program. Training/educational programs are classified into four categories as follows:- A. Associate and Diploma Degree Programs The authors revision covers a total of five programs; see Table I. West Virginia University [16], University of North Texas [17, 19] and North American educational institutions [20] from the USA offer associate degree programs of Cyber Forensics. Edith Cowan University [17, 21] and Canberra Institute of Technology [17] from Australia both offer Computer Forensic Advanced Diplomas. For the five training/education programs, only the West Virginia University shows an expectation to implement accreditation program; while internal and external are not in other programs. TABLE I. ASSOCIATE AND DIPLOMA DEGREE PROGRAMS Countries USA Australia Total Numbers of Training providers Internal External Stated/ expected Stated/ expected Accreditation Stated/ expected 1-1 B. Certificate Programs Eight Cyber forensics training/education programs offering certifications are analyzed.the programs vary in terms of providing a subject in computer forensic, to awarding academic certificate in digital forensics. In Australia, University of South Australia [17], and University of Melbourne School of Enterprise [33] offer Cyber forensics certification program. Only University of South Australia shows accreditation system. Likewise, West Virginia University [16] has expectations to have accreditation from an accrediting body recognized by the U.S. Department of Education, while the others programs such as Cypress College s CIS certificate programs [18], InfoSec Institute [23], SANS [36] and CyberSecurity Institute [37] don t show their accreditation system. It is important to note that the International Society of Forensic Computer Examiners (ISFCE) [22] offers Certified Computer Examiner (CCE) which primarily focuses on quality assurance program; whereas the internal quality is revised by ISFCE Certification Board, ISFCE Ethical Standards Committee and Certification Candidate Appeal Committee. Also, in order to maintain its external quality the ISFCE reviews all course material and assesses whether the curriculum adequately meets the testing standards for the Certified Computer Examiner (CCE) exam or not. TABLE II. CERTIFICATE PROGRAMS Countries USA Australia Total Numbers of Training providers Internal Stated/ expected External Stated/ expected Accreditation Stated/ expected C. Undergraduate Programs Undergraduate degree programs in Cyber forensic cover a wide range of topics. Twenty undergraduate programs from different countries are reviewed (see Table III). Ten training/education providers in USA [34, 35]: Central Michigan University [25], California State University [26], California State Polytechnic University [26], Poly Pomona [26], Longwood University [27], West Virginia University [16], University of North Texas [17] Sam Houston State University [29] and Department of Information and Computer Sciences Metropolitan State University [30] offer undergraduate degree programs in Cyber forensic and computer information system. Only West Virginia University offers a program with an expected accreditation V4-347

3 from accrediting bodies recognized by the U.S. Department of Education. In addition, the competency assessment quality assurance is not by all of training/education providers. Canterbury Christ Church University in U.K [31] provides an undergraduate degree in Cyber forensic programs and shows both competency assessment quality assurance and accreditation that comply by The Quality Assurance Agency for Higher Education (QAA), which fully met with European standards. Furthermore, eight training/education providers from Australia: University of Western Sydney [17], Garda College [9], Deakin University [28, 32], Edith Cowan University [17, 21] and Murdoch University [17, 24], provide Bachelor of Counter Terrorism, Security and Intelligence (Computer Science), Bachelor of Computer Science (Computer Security), Bachelor of Information Technology (Computer Security), and BSc. in Cyber Forensics, Information Security and Management. Three of them have accreditation bodies such as The Information Systems Audit and Control Association (ISACA) and Australian Computer Society (ACS), while all of them haven t claimed their competency assessment internal procedures. Hebei University of Police [10] in China offers a 4-year study digital forensics program, whose accreditation is not confirmed as well as the quality assurance system. TABLE III. UNDERGRADUATE PROGRAMS Countries USA U. K Australia China Total Numbers of Training providers Internal Stated/ expected External Stated/ expected Accreditation Stated/ expected D. Graduate Programs Master and graduate diploma programs have a significant contribution in Cyber forensics training/education fields. Several training/education providers conduct different types of Master/graduate diploma programs as shown in Table IV. In USA only West Virginia University [16] shows an accreditation program expectation by a recognized body of Education Department, while Longwood University [27] and University of North Texas [17] are not. Similarly all universities don t maintain their competency assessment quality assurance. In UK, only one program [31] offered at master degree level in Cyber forensics is reviewed. It shows an adoption of competency assessment quality assurance and accreditation. The rest of the others programs are from Australia. Edith Cowan University [17] provides Master of digital forensic, Master of computer security, Graduate diploma of digital forensics and Graduate certificate of digital forensics [21]. Also, the University of South Australia [17] offers Msc. (Computer & Info Sc.). Curtin University of Technology [17] provides Master of internet security and forensics. Macquarie University [17] offers Postgraduate Certificate in Computer Forensics. Furthermore, University of Melbourne School of Enterprise [17], [28] offers Master of forensics and enterprise security. However, only University of South Australia and Curtin University of Technology maintain their accreditation program by ACS, British Computer Society (BCS) and Australian and New Zealand Forensic Science Society (ANZFSS); while all of them don t state their competency assessment internal and external TABLE IV. GRADUATE PROGRAMS Countries USA U K. Australia Total Numbers of Training providers Internal Stated/ expected External Stated/ expected Accreditation Stated/ expected III DISCUSSION The notion of training/education quality is very old. Both private and public educational providers concern with products/services quality. If the services/products do not have market value due to poor quality, the institution will collapse. Cyber forensics education/training programs have specific purposes /objectives to target trainees. Those targets play a significant role to determine the quality assurance services. Regardless of the type of training program, traditional quality assurance methods such as library utilities, teaching and contact hours, examination monitoring and so forth are often impractical or irrelevant in today s Cyber forensic training/education reality. As mentioned earlier, the objective of this study focuses on competency assessment quality assurance and accreditation of the training/education program rather than the entire traditional quality assurance methods. The result in Table (I) (Associate and Diploma Degree Programs) shows similarities on the situation of both internal and accreditation. They are totally not in the whole programs. In addition to that, only one of four organizations (25%) confirmed its accreditation expectation. Table II which tabulates Certificate Programs shows only 12.5% internal and accreditation. The result of the analysis on Undergraduate Programs (Table III) shows 5% external, 5% internal and 25% V4-348

4 accreditation. Finally, Table IV, Master/Graduate diploma shows 10% to internal verifier, 10% external verifier, and 40% to accreditation. IV. CONCLUSION In summary, Cyber forensic training/education services proliferate to diverse qualifications, from a handful of day s workshop to Masters Degree in Cyber forensics. With the immaturity of education/training and practicing field, most of the training/education providers don t worry about the competency assessment quality assurance and accreditation. Therefore, the situation contributes on poor services delivery and outcomes. The study shows the total of competency assessment quality internal range from 0% to 12.5%, external is from 0% to 10% and accreditation is from 20% to 40. These results reflect that the area of Cyber forensic training/education has insufficient concerns on assessment quality assurance and accreditation. V. ACKNOWLEDGEMENT This work is of a research that has been done in (UTM), under support from Ministry of Science, Technology & Innovation, Malaysia. REFERENCES [1] W. Figg and Z. Zhou, computer Forensics Minor Curriculum Proposal, Department of Computer Information Systems, Dakota State University, Madison, SD 57042, portal.acm.org/ft_gateway.cfm?id= &type=pdf, 2007 [2] J. Fernandez, S. Smith, M. Garcia and D. Kar, Computer forensics: a critical need in computer science programs, Journal of Computing Sciences in Colleges, Volume 20 Issue 4, Consortium for Computing Sciences in Colleges, 2005 [3] C. Taylor, B. Endicott-Popovsky and A. Phillips, Forensics Education: Assessment and Measures of Excellence, Proceedings of the Second International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE'07), 2007 [4] J. Venter, Process Flows for Cyber Forensics Training and Operation, Pretoria, South Africa, researchspace.csir.co.za/dspace/bitstream/10204/1073/1/venter_2006.pdf, (2006). [5] R. Pidanick, An Investigation of Computer Forensics, Information System Control Journal, Volume 3, /Documents/jpdf043-InvestigationofComputerForensics.pdf [6] Z. Hamzah, E-Security Law & Strategy, Malayan Law Journal Sdn Bhd, Kelana Jaya Malaysia, KL, ISBN pp. 122 [7] D. Hopkins, Innovative Corporation Solutions, Inc, ofcomputerforensics.pdf, 2006 [8] Schroeder S.C., How to be a Digital Forensic Expert Witness, Systematic Approaches to Digital Forensic Engineering, First International Workshop on, 7-9 Nov. 2005, pp [9] D. Bem and E. Huebner Computer Forensics Workshop for Undergraduate Students, crpit.com/confpapers/crpitv78bem.pdf,2008, last surf on 8 Aug [10] L. Zhijun and W. Ning, Developing a Computer Forensics Program in Police Higher Education, Computer Science & Education. ICCSE '09. 4th International Conference on, July 2009, pp [11] S. Lim, Demand up, supply short for forensic professionals Anonymous, New Straits Times, Kuala Lumpur, Jul 20, pp. 5 [12] K Nance, H. Armstrong and C. Armstrong, Defining an Education Agenda, System Sciences (HICSS), rd Hawaii International Conference on, Digital Object Identifier: /HICSS , Publication Year: 2010, pp [13] JJ Barbara, Certification and Accreditation Overview, , [14] EURIM, Supplying the Skills for Justice, [15] W. Pond, Twenty-first century education and training: Implications for quality assurance, The Internet and Higher Education, Volume 4, Issues 3-4, 2001, pp [16] West Virginia University Forensic Science Initiative, Technical Working Group for Education and Training in Digital, [17] E. Huebner, D. Bem and Ch. Ruan, Computer Forensics Tertiary Education in Australia, Computer Science and Software Engineering, 2008 International Conference on, Volume 5, Dec pp [18] D. Wassenaar, D. Woo and P. Wu, A certificate program in computer forensics, Journal of Computing Sciences in Colleges, Volume 24 Issue 4, Consortium for Computing Sciences in Colleges, 2009 [19] Graduate Studies, Criminal justice, 10 Aug 2010 [20] L. Gttschalk, J. Liu, B. Dathan, S. Fitzgerald and M. Stein, Computer forensics programs in higher education: a preliminary study, Proceedings of the 36th SIGCSE technical symposium on Computer science education, ACM, [21] Edith Cowan University, Digital forensic courses, :jzqn_jrbvsm&cof=FORID:11&sa=Search&tab=websi te&x=12&y=9 [22] ISFCE, CCE Certification, The International Society of Forensic Computer Examiners, [23] InfoSec Institute, Computer Forensics Training, [24] Murdoch University, Cyber Forensics, Security-and-Management/ [25] Yasinsac A., Erbacher R.F., Marks D.G., Pollitt M.M. and Sommer, P.M, Computer forensics education, Security & Privacy, IEEE, Volume 1, Issue 4, July-Aug pp [26] L. Soe, D. Manson and M. Wright, Establishing Network Computer Forensics Classes, InfoSecCD '04, Proceedings of the 1st annual conference on Information security curriculum development, ACM, October [27] G. Dardick and L. Lau, Interdisciplinary minor in digital forensics, security and law, SIGITE '05, Proceedings of the 6th conference on Information technology education, ACM, October 2005 [28] Deakin university, Bachelor of Information Technology (I.T. Security), =digital%20forensic [29] D. Collins and T. McGuire, Using the dc3 forensic challenge as a basis for a special topics digital forensics upper level undergraduate course*, Journal of Computing Sciences in Colleges, Volume 23 Issue 6, Consortium for Computing Sciences in Colleges, June [30] J. Liu, Implementing a baccalaureate program in computer forensics*, Implementing a baccalaureate program in computer forensics, Journal of Computing Sciences in Colleges, Volume 25 Issue 3, Consortium for Computing Sciences in Colleges, January [31] Stephens, Paul, Induruwa and Abhaya, Cybercrime investigation training and specialist education for the European Union, Proceedings - 2nd International Annual Workshop on Digital Forensics and Incident Analysis, WDFIA 2007, Proceedings - 2nd International Annual Workshop on Digital Forensics and Incident Analysis, WDFIA pp [32] Batten L and L. Pan, Teaching Digital Forensics to Undergraduate Students, Security & Privacy, IEEE,Volume 6, Issue 3, May-June 2008, pp V4-349

5 [33] MCCP, Master of eforensics and Enterprise Security, [34] L. Troell, Y. Pan, B. Stackpole, Forensic Course Development Computer Forensics, CITC4 '03, Proceedings of the 4th conference on Information technology curriculum, ACM, October 2003I. [35] Luther T. et al. Forensic Course Development One Year Later. SIGITE 04, October 28 30, 2004, Salt Lake City, Utah, USA. ACM /04/0010 [36] SANS, GIAC Forensic Certification, [37] CSI, Computer forensic fundamentals, amentals.htm V4-350