A study of information and communication security forensic technology capability in Taiwan

There are constant occurrences of Internet security problems due to its rapid development. It is important to maintain Internet security system during and after the occurrences to collect evidence and forensics essences by various devices, such as hard disk, system log, firewall, IDS log, processes, as well as Internet connections. It would be even more beneficial to the forensic process if evidence could be established and kept well before such an incident happened. Most government organizations lack sufficient knowledge of security system techniques and they still believe that this technical part of the work belongs to the police. In fact, we cannot guarantee a perfect stage, but at least we can figure out what the problem is and trace where the attack is from, and that is the mission of computer forensics. Schools or institutes that are engaged in research and development of relative security system techniques are doing their own work; thus, capabilities of computer forensics have been dispersed. Therefore, in order to enhance the forensic skill of information and communication security and ability, what we really need is a complete plan so as to integrate the forensic skill of information and communication security and ability.