Embedding Computer Forensics Research into the Curriculum

1
Embedding Computer Forensics Research into the
Curriculum
John Haggerty Distributed Multimedia and Security
Group, Liverpool John Moores University J.Hagger
ty_at_ljmu.ac.uk http//www.cms.livjm.ac.uk/cmpjhagg/
index.htm
2
Outline of talk

• JMU background
• Research and computer forensics
• Commercial versus academic research
• Training versus education
• Research contribution to education
• Research input to overcome problems
• Some JMU approaches
• Summary

3
Background to JMU

• Lecturer in Computer Security and Forensic
  Computing
• Computer security and forensics background
• Academic research
• Practical experience
• Requirement for wider knowledge of security and
  forensic issues

4
Module background

• Forensic Computing module run first time
  2004/2005
• Extending to MSc in 2007/2008
• Initial expectation to complement mainstream
  Forensics programme at JMU
• Different levels of expectation and ability
• Forensic Computing
• BSc (level 3)
• Approx. 100 students (up from approx. 50
  2005/2006)
• IS, MMS, CS and SE options (as well as students
  on traditional Forensics programme)

5
Computer Forensics

• Computer Forensics receiving much interest
• Emergence from the traditional Forensics field
• Defined as the application of computer
  investigation and analysis techniques to
  determine evidence
• Extension of the field beyond law enforcement
• National security
• Internal investigations
• Businesses

6
Research and computer forensics

• Various strands of research impact on computer
  forensics courses
• Teaching in HE, computer forensics, traditional
  forensics, security, systems, etc.
• Computer forensics a burgeoning research area
• Conferences
• Books
• Journals
• Academia well placed due to focus on
  best-practice teaching and research in computer
  forensics

7
Research - Teaching

• Universities focus on providing best learning
  experience for their students
• Must meet a number of criteria
• HEFCE
• QAA
• Professional bodies e.g. BCS
• Much research has been conducted into teaching in
  universities
• Will not discuss further in this talk as much has
  been said already in this workshop

8
Commercial Research

• Computer forensics has relied on commercial tools
• Used by practitioners
• Commercial vendors protect their investment
• Commercial research and development to get
  product to market
• Niche tools
• Expensive
• ROI of commercial tools through 2 means
• Sales of the applications
• Training provision

9
Academic Research

• Academic research is multi-disciplinary
• Between academic fields, e.g. computing and law
• Within computing, e.g. information systems and
  software engineering
• Computer forensics is also multi-disciplinary
• Management processes
• Understanding of computers
• Computer forensics well-suited to embed research
  into the curriculum
• Approach focused not software-tool focused

10
Research contribution to education

• Research can be seen in terms of
• Knowledge of facts
• Knowledge of theory
• Knowledge of methods
• Knowledge of other fields of study
• Knowledge of other work
• Learning through practice/experience
• Insight into problems
• Research does not accept that current practice
  equals best practice
• Education for the future not the present

11
Training versus education

• Computer forensics commercial training versus
  academic education

A. Yasinsac et al, Computer Forensics
Education, IEEE Security Privacy, Jul/Aug
2003, pp. 15-23.
12
Research in education
Conception of Knowledge Objective and separate
from knowers
Disciplinary Research culture
Departmental Learning milieu
Conception of Teaching Teacher focused,
information transmission
A. Brew, Teaching Research New relationships
and their implications for inquiry-based teaching
and learning in higher education, Higher
Education Research Development, vol. 22, no. 1,
2003.
13
Research in education
Disciplinary Research culture
Departmental Learning milieu
14
Overcoming problems

• Embedding research can overcome some problems
• Student engagement in the subject area
• Understanding
• Empowerment/learning autonomy
• Relevance to the practitioner world
• Challenging existing practices
• Not attempting to make all students academics
• Makes it more fun for the lecturer!

15
JMU approach

• A number of techniques are used on the course
• Group work
• PBL
• PBL-based coursework
• Discussions of research-related issues
• Literature includes mix of computer forensics key
  textbooks and research papers
• Where possible, research is brought into the
  lectures
• Focus on future issues and practices

16
JMU initiative

• Advances in Computer Security and Forensics
  Conference
• First conference July 2006, second in July 2007
• Mix between security and forensics research
• Bringing academia and practitioners together
• MSc and undergraduate students invited to attend
  for no fee
• Encourage interest in research
• Enhance their studies
• Get them talking to researchers and practitioners
  on informal basis

17
Summary

• Computer forensics a burgeoning research area
  challenging existing practices and approaches
• University is well placed to teach computer
  forensics due to teaching best practice and
  research blend
• Education for the future not the present
• Embedding research can overcome some traditional
  problems (and make it more interesting for the
  lecturer)