Developing an Innovative Baccalaureate Program in Computer Forensics

Developing an Innovative Baccalaureate Program in Computer Forensics Jigang Liu Department of Information and Computer Sciences Metropolitan State University St. Paul, Minnesota 55106 jigang.liu@metrostate.edu Abstract - Motivated by the demand of the industry and the increasing concern in homeland security, a baccalaureate program in computer forensics has been developed and begun in fall 2005. This 12-credit multidisciplinary program consists of courses in criminal justice, law enforcement, political science, mathematics, computer science, and computer forensics. A year since its implementation, the program has shown its potentials and strengths, and both students and industries have demonstrated a strong interest in the program. Index Terms - computer forensics education, curriculum design, and backwards design method. 1. INTRODUCTION Rapid developments in Internet technology and dramatic advances in computing research and application have made digital information critical to our daily lives in terms of convenience as well as security. These developments and advances also challenge the traditional computer science education and simultaneously, stimulate the innovation of curricula in all computing related fields CC2005 [1] indicates that the landscape of the computing disciplines has undergone dramatic change as a result of the explosion of computing during the 1990s. The computing field has evolved to the point that we are seeing the emergence of degree programs that are focused on the challenges that now confront both the computing profession and our computing-dependent society as a whole. Examples of those degrees programs include Computer Game Development [2], Bioinformatics [], and Information Security and Assurance []. Computer forensics is one of those innovated programs. A detailed discussion of the program will be given in the next section. As the globalization of the world economy continues to grow, many computer program developer jobs are moved overseas. As a result, the majority of the IT/IS job market in the States has switched to computer related service areas. This change in demand has made computer science faculty re-think what to teach and how to retain their students. Peter Denning described in an article in Communications of the ACM November 2005 issue [5] that the recent decreases of enrollment in computer science programs signal a chasm contemporary concerns of those choosing careers. To meet the challenge, Peter made several suggestions in terms of recentering computer science education. One of his suggestions for innovation themes in freshman-sophomore courses is a module on computer forensics. Since the 9/11 attack in 2001 and the Enron financial scandal in early 2002, computer forensics has developed into one of the fastest-growing areas in the computer and information technology industry. The demand for the expertise in computer forensics increases as more and more criminal activities involve digital equipment and data. Like what Michael Erbschloe, Vice President of Research, Computer Economics, Carlsbad, California, wrote in 2002, computer forensics is one of the largest growth professions of the 21 st century. We need to train at least 50,000 more computer crime fighters to stem the global tide of computer attacks. [6] Industrial demands have been the driving forces for faculty to design new programs in computing-related fields since the early 1990s. But curricular development in computer forensics has not reached a satisfactory level. As Yasinsac indicated in 200 [7], only a few universities support computer forensics programs, and most comprise only a single course. He expects this to change over the next three to five years, and he hopes that evolving programs can leverage experience gained through the recent US National Security Agency-prompted expansion of information-assurance education programs. A survey on computer forensics curricula in higher education published in 2005 [8] shows only a handful of two-year colleges offering computer forensics programs and just four colleges/universities running a track/emphasis type of fouryear program in computer forensics or a similar field. Since then, many schools have started to offer a course, concentration, or certificate program in computer forensics. However, experience tells us that without a solid discipline structure and a well-defined curriculum, computer forensics education cannot advance any further. The next section presents an analysis of the existing programs and their structures. The design issues, such as design philosophy, strategies, methods, and concerns are discussed in section. Section will introduce the new computer forensics curriculum. The current status of the implementation of the program is reported in section 5. Finally, in section 6, conclusions are presented. between our historical emphasis on programming and the 1-2-0257-/06/$20.00 2006 IEEE October 28 1, 2006, San Diego, CA 6 th ASEE/IEEE Frontiers in Education Conference S1H-1

2. ANALYSIS OF EXISTING PROGRAMS Computer forensics curricula have been approached from some different disciplines, such as, law enforcement and criminal justice [9], accounting and management [10], as well as some computing related disciplines (e.g. computer science, computer information system, and information technology). In this paper, our focus is solely on the development of computer forensics curriculum in a computing related department. As the study [8] indicated, many schools have started to introduce computer forensics concepts and technology. Some of them even created a track, a concentration, a minor, or an emphasis on computer forensics by grouping courses from criminal justice, law enforcement, and computer science. Although there are more universities/colleges that have established four-year programs in the field since Gottschalk s paper [8] was written, very few schools offer a completelyreconstructed four-year program in computer forensics. The need for a four-year program in computer forensics is rising. As the job market indicates, for the last three months, at least three universities have advertised for a tenure-track computer forensics faculty (Sam Houston State University in Texas, Southern Utah University, and Metropolitan State University in Minnesota). As summarized in [8], surveyed four-year programs vary significantly in structure, course coverage, and the background of the students. This still holds true for the current situation. Before laying out our design philosophy and curriculum structure, we will first discuss three typical programs in terms of curriculum emphasis, course coverage, program characteristics, and overall impression. The computer forensics degree program offered by the business administration division at Defiance College, Ohio, requires 68 credits in the major. As the program description [10] indicates, participants in this program will learn how to provide a secure computer environment and learn techniques for collecting and analyzing computer-related evidence. A graduate of this program will be prepared for entry-level positions as a data recovery technician or member of a security team who monitors and supports computer-based security systems. The requirements for this degree include two law courses (criminal law and business law), three criminal justices courses, and eight computer forensics courses. In addition, students need to take four IT courses to cover programming, database, network topics, and IT ethics. The unique part of the program is its requirements of a course in financial accounting and a course in managerial accounting. Furthermore, it even requires a national certification in computer forensics. The department of Computer and Information Science at St. Ambrose University in Iowa provides their students with a computer forensics program called Computer Investigations and Criminal Justice [11]. The program requires 51 credits in major. There are four or five computer science courses which cover system, network, security, Internet management, and computing ethics. Two computer forensics courses introduce network forensics and general concepts in computer forensics. Four of the eight criminal justice courses focus on criminal law, procedure, prevention, evidence, and investigation. The strength of the program is its emphasis on networking and network forensics. However, detailed information is not available because this major program was recently moved from the Criminal Justice Department to the CIS Department. [11] Champlain College in Vermont provides their students with an A.S. or a B.S. in Computer and Digital Forensics. As described in [12] the A.S. program focuses on the basics of computer forensics with an emphasis on the legal aspects and techniques for such investigation. The B.S. adds more in-depth computer forensics courses and broadens the curriculum to include additional aspects of forensic analysis, with more of a focus on the application of the technology to an investigation and the content of what is being analyzed. Both programs started about two years ago and progressed very well in terms of enrollments and curriculum development. The B.S. program includes two law courses (criminal law and business law), five IT courses (file management and programming, operating systems, data communications, and computer and network security), and eight computer forensics courses that cover various aspects of computer forensics (analysis of digital media, white color crime, and computer forensics I and II). The unique feature of this program is its inclusion of a regular accounting course and a computer forensics course in forensic accounting. The programs are administrated by a center for digital investigation.. Since all three schools have just started to run their programs in computer forensics, lessons will be learned and experiences will be accumulated, and then improvements will be made to further develop these programs.. PROGRAM DESIGN ISSUES There are several different ways to design a curriculum for a demanding subject. One example is the for dummy approach where one incorporates various interests to meet the curiosity of all people timely. One also can try to revamp, or patch, an existing program to quickly adapt new technologies and rapidly develop a newer, more attractive program. However, we decided that we have to take a systematic approach with a vision for the future for building a baccalaureate program. The for dummy approach is good for meeting the immediate needs of industry, satisfying curiosity, and grasping fundamental concepts. It will help people handle common situations with limited training. The approach is very efficient and effective at the beginning. However, this is a short term strategy and therefore, it only works well with the current and basic needs. On the other hand, the patching technique will take learning to a deeper as well as broader study of the area. The process will take more time and programs will cover more topics. In addition to knowing how, students will also learn why. Although the patching technique provides students with a deeper and broader understanding of the field, they will still have an unbalanced knowledge for this interdisciplinary field. 1-2-0257-/06/$20.00 2006 IEEE October 28 1, 2006, San Diego, CA 6 th ASEE/IEEE Frontiers in Education Conference S1H-2

We decided to follow the backward design model, otherwise known as a practioner s model. We first studied the needs of the industry, clustered them into groups of knowledge required in the field, and then derived the topics from the groups. Next, we try to find supporting areas for the groups as well as what can be created from the groups. To understand what the industry and law enforcement needs, we started with the currently available certificate programs. As introduced in [1], these certificates include the CCE (Certified Computer Examiner) [1] administrated mainly by the International Society of Forensic Computer Examiners, the CIFI (Certified Information Forensics Investigator) [15] offered by the International Information Systems Forensics Association, and the CFCE (Certified Forensic Computer Examiner) [16] managed by the International Association of Computer Investigative Specialists. Since there is no single certificate that dominates the market and is recognized by the majority of the industry and law enforcement, our analysis was based on discussions of computer forensics experts. In Table 1, provides a list of topics in a computer forensics course presented in [6]. Table 1 Topics of a computer forensics course 1) Computer evidence processing 2) Preservation of evidence ) Trojan horse programs ) Computer forensics documentation 5) File slack 6) Data-hiding techniques 7) Internet-related investigation 8) Dual-purpose programs 9) Text search techniques 10) Fuzzy logic tools used to identify previously unknown text 11) Disk structure 12) Data encryption 1) Matching a floppy diskette to a computer 1) Data compression 15) Erased files 16) Internet abuse identification and detection 17) The boot process and memory resident programs We can cluster these 17 topics into four different categories as shown in Table 2. Table 2 classification of the topics Group Topics a) Operating Systems and Networks 5), 11), 15), and 17) b) Computer Security ), 8), and 12) c) Procedure/Standard/Techniques 1), 2), and 7) d) Analysis and Presentation 6), 9), 10), 1), 1), and 16) To support group a), we studied our existing computer science courses in operating systems and computer networks. Due to the prerequisites for the courses, we found it is impossible to include these existing courses into the new program. On the other hand, computer forensics majors do need extensive knowledge in system and network configuration and administration. Therefore, the existing courses do not meet those needs. Group b) includes the subjects mostly covered in computer science courses so that we don t need to create new courses. Groups c) and d) cover the core topics in computer forensics where those topics rely not only on computing related knowledge, but also the subjects discussed in law, legal process, incident investigation, and government policies and procedures. In summary, a computer forensics program should include four major areas as shown in Table. Table Four major areas of a computer forensics program 1. Computer Science and Foundations 1) Cryptography and Security 2) Communication and Network ) Systems and Analysis 2. Procedures, Methods, and Policies 1) Forensic Science / Criminology 2) Incident Investigation ) The U.S. Government. Legal System and Law 1) Legal Procedure / Ethics 2) Computer / Business Law ) Constitutional Law. Computer Forensics 1) Data Seizure and Preservation 2) Digital Evidence Analysis ) Documentation and Presentation. A NEW BACCALAUREATE PROGRAM The program we have designed and implemented is a baccalaureate degree program in computer forensics. The program requires 12 credits and is offered through the department of Information and Computer Sciences at the College of Arts and Sciences. The goal of the program is to provide students with the knowledge and skills in computer science, information assurance, computer incident investigation, cyberspace ethics, and computer laws so that they can succeed in protecting company or organization interests. Graduates can also assist law firms in dealing with civil litigations and law enforcement in fighting against cyber terrorism and crimes. The strength of our program is its balance between training and educating current and future information technology professionals, although many courses in the curriculum can be used in training law enforcement officials. We believe that a balanced program will not only help students to enter the job market but also prepare them to adapt new technologies by themselves in the future. Computer forensics is multidisciplinary by nature due to its foundation in two otherwise technologically separate fields, computing and law [17] [18] [19] [20]. Unlike other programs, we have put constitution law as the first required law course for our major. Our concern is that to be a good investigator, 1-2-0257-/06/$20.00 2006 IEEE October 28 1, 2006, San Diego, CA 6 th ASEE/IEEE Frontiers in Education Conference S1H-

one must know an individual s rights under the First and Fourth Amendments. To support the community and technical colleges in the state, the program is primarily designed for transfer students. Due to the nature of the work in computer forensics, we highly recommend our students to get a two-year degree in a system administration area, such as an AS in network administration, database administration, or system administration. Since our program requires a large amount of coursework in criminal justice, law, and investigation procedure and techniques, we also encourage students with a two-year or a four-year degree in criminal justices, law enforcement, paralegal, or accounting to pursue a degree or a second degree in computer forensics. The admission requirements for the program are consistent with the mission of our university in that it encourages adult and working students to apply. Since most of our students have some previous college education, we have provided them with as much flexibility in admission as possible. For instance, instead of listing some specific courses, we ask for the number of credits in various disciplines. For the core courses, we allow students to apply equivalent courses to meet the requirements. If a student has been awarded a two-year degree from a college that has an articulation agreement with us, she or he can be automatically admitted to the program and start the final two years of the study. For those who have a two-year degree from a college that does not have an articulation agreement with us, their applications to the program are evaluated based on the guideline shown in Table. Table Admission Requirements for transfer students a) Admitted to the university b) Completed at least 60 credits of undergraduate study: 1) General education credits 16 to 0 credits 2) Major credits 0 to credits which include: i) Computer science and information technology courses or 16 credits ii) Criminal justice/law enforcement 2 courses or 8 credits iii) Political science 1 course or credits vi) Mathematics (college algebra or above) 1 course or credits c) An average GPA of 2.5 or higher for the equivalent courses of the following courses: 1) CFS 262 Computer and Operating Systems Fundamentals I 2) CFS 26 Computer and Operating Systems Fundamentals II ) CJS 210 Constitutional Law For those students who have some college credits but don t have a two-year degree, their college credits are evaluated according to their equivalents at our college and then the students can join the study of the program at our university. For the first two years of the study, students need to take 0 credits in general education and 0 credits in the major (computer forensics). The courses required for the major during the first two years are listed in Table 5. Table 5 Major requirements in the first two-year study a) Computer Science and Technology (16 credits) Required: CFS 262 Computer and Operating System Fundamentals I ( credits) CFS 26 Computer and Operating System Fundamentals II ( credits) CFS 280 Introduction to Computer Forensics ( credits) ICS 10 Programming Fundamentals ( credits) b) Criminal Justice and Law Enforcement (6 credits) Required: CJS 210 Constitutional Law ( credits) One of the following courses: CJS 101 Introduction to Criminal Justice ( credits) CJS 200 Literature and Methods in Criminal Justice ( credits) LAWE 220 Legal Issues in Law Enforcement ( credits) c) Political Science ( or credits): One of the following courses: POL 101 Introduction to American Government and Politics ( credits) POL 01 Citizenship in a Global Context ( credits) d) Mathematics ( credits): One of the following courses: Math 210 Calculus I ( credits) STAT 201 Statistics ( credits) Both students who join the program in their freshman year and students who transfer into the program in their junior year must fulfill the requirements detailed in Table 6. Table 6 Last two-year major requirements a) Required Core courses (2 credits) CFS 80 Digital Evidence Analysis ( credits) CFS 99 Computer Forensics Internship/Capstone ( credits) ICS 82 Computer Security ( credits) ICS 61 Data and Voice Communication ( credits) LAWE 25 Criminal Procedure and Investigations ( credits) POL 1 Law and the Legal Process ( credits) b) Electives (11 credits) Group I Criminal Justice (one of the following courses) CJS 20 Applied Criminology ( credits) CJS 67 Introduction to Forensic Science ( credits) CJS 87 White Collar Crime ( credits) Group II Law (one of the following courses) BLAW 10 Business Law: UCC and Contracts ( credits) ICS 8 Computer Law ( credits) POL Constitutional Law ( credits) Group III Ethics (one of the following courses) CJS/75/PHIL 25 Criminal Justice Ethics ( credits) PHIL 27 Ethics in the Information Age ( credits) PSYC 19 Technology on Human and Org. Behavior ( credits) 1-2-0257-/06/$20.00 2006 IEEE October 28 1, 2006, San Diego, CA 6 th ASEE/IEEE Frontiers in Education Conference S1H-

For those who would like to start the program at the university from scratch, a four-year plan is provided in Table 7. Table 7 A recommended four-year curriculum plan Semester 1 Course Credit MATH 115 College Algebra WRIT 11 Writing I ICS 10 Programming Fundamentals Comm 10 Public Speaking Semester total 1 Semester 2 WRIT 21 Writing II (Goal I) CFS 262 Computer and Operating System Fundamentals I CJS 101 Introduction to Criminal Justice PHYS 111 General Physics 5 Semester total 16 Semester CFS 26 Computer and Operating System Fundamentals II CJS 210 Constitutional Law STAT 201 Statistics Free electives 5 Semester Total 16 Semester CFS 280 Introduction to Computer Forensics POL 01 Citizenship in a Global Context NATH 201 Nature Study Free electives Semester Total 16 Semester 5 Credit ICS 82 Computer Security POL 1 Law and the Legal Process LAWE 25 Criminal Procedure and Investigation ANTH 01 Approaches to Cultural Anthropology Semester total 16 Semester 6 CFS 80 Digital Evidence Analysis ICS 61 Data and Voice Communication CJS 87 White Collar Crime CJS 0 Comparative Criminal Justice Semester total 15 Semester 7 Semester 8 CFS 80 Computer Law PHIL 25 Criminal Justice Ethics Comm 02 Advanced Public Speaking Free elective Semester Total 16 CFS 99 Computer Forensics Internship/Capstone Project SOC 01 Contemporary Sociology Free electives 8 Semester Total 15 Total 12 5. CURRENT IMPLEMENTATION STATUS We began writing the program proposal in the summer of 200 and it took us two years to complete the program approval process through the department, college, university, and state university systems. The program began in Fall 2005 and we have received very positive reviews from our students. Many people are interested in acquiring more information about the program. So far we have held roughly ten new program information meetings and had over one hundred students register. In addition, we have approximately one hundred people on our mailing list. So far, we have thirty three students admitted to the program and are very pleased to notice that the new program has attracted a substantial number of female students. The gender distribution is 8% women and 52% men, where the gender distribution in our CS program is 1 % women and 86% men, and in our CIS program is 25% women and 75% men. Students told us that the balance of the subjects in the curriculum and the opportunities in working in the areas to support legal systems and law enforcement are two major attractors for female students. In other words, this program provides many female students the opportunities in helping law enforcement fight against terrorists and provide a safe environment for the community. As we have presented above, there are six new courses listed in the curriculum. We have offered three of these new courses and have scheduled to offer the other three courses in the next school year. We expect the first graduating class of this program in Spring 2007. 6. CONCLUSIONS Though it was a difficult process to get our proposal approved, there are greater challenges afterwards. These challenges include, but are not limited to, textbook selections, lab setup, and recruiting faculty. Since computer forensics is a new area of study, many books are written based on individual experiences and focus only on industry practice. Therefore, there are very few textbooks on computer forensics available. Moreover, the different backgrounds of the students present another challenge to the selection of the textbooks as well. Due to sensitivity, computer forensic labs should be maintained in a way in which it cannot be used for illegal activities. Determining how to setup a computer forensic lab, managing the lab, and using the lab are very critical to the program as well as the university. In terms of implementing the program, the biggest challenge is finding qualified instructors for the computer forensics courses. Due to the limited number of experts in the field, recruiting faculty is the most difficult task in implementing the program. To improve the program, our future work includes developing new courses that broaden areas covered by computer forensics. Consistently updating course content will be a routine task for our program. Faculty training and recruitment are two important things for us to do next year. To 1-2-0257-/06/$20.00 2006 IEEE October 28 1, 2006, San Diego, CA 6 th ASEE/IEEE Frontiers in Education Conference S1H-5

meet the needs of our students, we are also planning on creating a minor/certificate program in computer forensics in the coming year. REFERENCES [1] Computing Curricula 2005: Overview Report, (last accessed on March 26, 2006) http://www.acm.org/education/curric_vols/cc2005- March06Final.pdf [2] Game Development Degree Programs at University of Denver, (last accessed on March 26, 2006) http://www.cs.du.edu/gamedevelopment/ [] BioInformatics program at University of Northern Iowa, (last accessed on March 26, 2006) http://www.cs.uni.edu/~okane/cgibin/newpres/marbl/ [] Whitman, M. E. and Mattord, H. J., A Draft Model Curriculum for Programs of Study in Information Security and Assurance, 200 Colloquium for Information Systems Security Education, West Point, New York, June 7 to 10, 200 [5] Denning, P. J. and McGettrick, A., Recentering Computer Science, Communications of the ACM, Nov. 2005, pp15 19 [6] Vacca, John R., Computer Forensics: Computer Crime Scene Investigation, Charles River Media, Inc., 2002 [7] Yasinsac, Alex and et al, Computer Forensics Education, IEEE Security and Privacy, The IEEE Computer Society, July/August 200, pp15 to pp2. [8] Gottschalk, L., et. al., Computer Forensics Programs in Higher Education: A Preliminary Study, the proceedings of the 6 th SIGCSE Technical Symposium on Computer Science Education, St. Louis, Missouri, Feb. 2-27, 2005, pp17-151 [9] Master of Science in Forensic Computing at John Jay College of Criminal Justice (New York City), (last accessed on March 28, 2006) http://www.jjay.cuny.edu/programsgraduate/proggraduateforensiccom puting.asp [10] Computer Forensics program at Defiance College (Ohio), (last accessed on March 28, 2006) http://www.defiance.edu/pages/bus_majors_cf.html [11] St. Ambrose University, Computer Investigations and Criminal Justice Program, (last accessed March 26, 2006) http://web.sau.edu/cis/index.htm [12] The Computer and Digital Forensics Program at Champlain College (Vermont), (last accessed on March 28, 2006) http://digitalforensics.champlain.edu/about_cdf.html [1] Solomon, M. G., Barrett, D., and Broom, N., Computer Forensics: Jump Start, SYBEX, Ind., 2005 [1] CCE: http://www.certified-computer-examiner.com/ (last accessed on May 22, 2006) [15] CIFI: http://www.iisfa.org/ (last accessed on May 22, 2006) [16] CFCE: http://www.iacis.info/iacisv2/pages/home.php (last accessed on May 22, 2006) [17] Armstrong, C., Mastering Computer Forensics, the proceedings of IFIP 200 Security Education and Critical Infrastructures, Monterey, CA, June 200, pp151-158. [18] Farmer, D. and Venema, W., Forensic Discovery, Addison Wesley, 2005 [19] Middleton, B., Cyber Crime Investigator s Field Guide, Auerbach Publications, CRC Press LLC, 2002 [20] Nelson, Bill and et al, Guide to Computer Forensics and Investigations, Thomson, 200 1-2-0257-/06/$20.00 2006 IEEE October 28 1, 2006, San Diego, CA 6 th ASEE/IEEE Frontiers in Education Conference S1H-6