Enhancing Traditional Reactive Digital Forensics to a Proactive Digital Forensics Standard Operating Procedure (P-DEFSOP): A Case Study of DEFSOP and ISO 27035
Source abstract
Abstract
With the growing intensity of global cybersecurity threats and the rapid advancement of attack techniques, strengthening enterprise information and communication technology (ICT) infrastructures and enhancing digital forensics have become critical imperatives. Cloud environments, in particular, present substantial challenges due to the limited availability of effective forensic tools and the pressing demand for impartial and legally admissible digital evidence. To address these challenges, we propose a proactive digital forensics mechanism (P-DFM) designed for emergency incident management in enterprise settings. This mechanism integrates a range of forensic tools to identify and preserve critical digital evidence. It also incorporates the MITRE ATT&CK framework with Security Information and Event Management (SIEM) and Managed Detection and Response (MDR) systems to enable comprehensive and timely threat detection and analysis. The principal contribution of this study is the formulation of a novel Proactive Digital Evidence Forensics Standard Operating Procedure (P-DEFSOP), which enhances the accuracy and efficiency of security threat detection and forensic analysis while ensuring that digital evidence remains legally admissible. This advancement significantly reinforces the cybersecurity posture of enterprise networks. Our approach is systematically grounded in the Digital Evidence Forensics Standard Operating Procedure (DEFSOP) framework and complies with internationally recognized digital forensic standards, including ISO/IEC 27035 and ISO/IEC 27037, to ensure the integrity, reliability, validity, and legal admissibility of digital evidence throughout the forensic process. Given the complexity of cloud computing infrastructures—such as Chunghwa Telecom HiCloud, Amazon Web Services (AWS), Google Cloud, and Microsoft Azure—we underscore the critical importance of impartial and standardized digital forensic services in cloud-based environments.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Digital and Cyber Forensics · Advanced Malware Detection Techniques · Internet Traffic Analysis and Secure E-voting
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Science and Information Engineering, Tatung University, No 40, Sec. 3, Zhongshan N. Rd., Taipei City 104327, Taiwan
References (25)
Show source-provided references
1. CardinalOps (2025, September 02). 5th Annual State of SIEM Detection Risk Report. Available online: https://www.prnewswire.com/news-releases/enterprise-siems-miss-79-of-mitre-attck-techniques-used-by-adversaries-according-to-cardinalops-5th-annual-report-302473779.html.
2. Brno, T. (2011, January 15–17). The Proactive and Reactive Digital Forensics Investigation Process: A Systematic Literature Review. Proceedings of the International Conference on Information Security and Assurance (ISA), Brno, Czech Republic.
3. Machaka, V., and Balan, T. (2022). Investigating Proactive Digital Forensics Leveraging Adversary Emulation. Appl. Sci., 12.10.3390/app12189077 ↗
4. Integrated Digital Forensic Process Model10.1016/j.cose.2013.05.001 ↗
5. Potential applicability of blockchain technology in the maintenance of chain of custody in forensic casework10.1186/s41935-023-00383-w ↗
6. Grobler, C.P., Louwrens, C.P., and von Solms, S.H. (2010, January 15–18). A Framework to Guide the Implementation of Proactive Digital Forensics in Organisations. Proceedings of the 2010 International Conference on Availability, Reliability and Security (ARES), Krakow Poland.10.1109/ARES.2010.62 ↗
7. Makura, S.M., Venter, H.S., Ikuesan, R.A., Kebande, V.R., and Karie, N.M. (2020, January 2–5). Proactive Forensics: Keystroke Logging from the Cloud as Potential Digital Evidence for Forensic Readiness Purposes. Proceedings of the 2020 IEEE International Conference on Informatics, IoT, and Enabling Technologies (ICIoT), Doha, Qatar.10.1109/ICIoT48696.2020.9089494 ↗
8. Yang, S.-H., Chao, H.-C., and Lin, I.-L. (2020). A Study on Establishing Cybersecurity Incident Response Procedures and Practical Validation: Implementing ISO 27035 as an Example. [Master’s Thesis, National Ilan University].
9. Establishing an Integrated Digital Evidence Forensics Standard Operating Procedure for Mobile Forensics (iDEFSOP-MF) and Actual Cases Verification Research-taking the actual cases and verification of the Criminal Investigation Bureau as an example
10. Research on the Construction of the Mobile Forensics Standard Operating Procedure (DEFSOP-MF) and the Integration of International Forensic Standards—Integration of ISO27037, ISO27041, ISO27042 and ISO27043 Comparative Analysis as an Example
11. (2023). Information Technology—Information Security Incident Management—Part 1: Principles and Process (Standard No. ISO/IEC 27035-1:2023).
12. (2020). Information Technology—Information Security Incident Management—Part 3: Guidelines for Incident Response Operations (Standard No. ISO/IEC 27035-3:2020).
13. Heriyanto, T., and Ali, S. (2014). Kali Linux—Assuring Security by Penetration Testing: Master the Art of Penetration Testing with Kali Linux, Packt Publishing.10.1016/S1353-4858(14)70077-7 ↗
14. Building Resilient Cybersecurity Strategies: Integration of ISO/IEC 27001 and ISO/IEC 27035 for 2025
15. Recommendations for a framework for handling security incidents of electronic-based government systems (SPBE) using the ISO/IEC 27035: 2023 standard10.35877/454RI.jinav2747 ↗
16. MITRE ATT&CK (2020). ATT&CK Design and Philosophy, MITRE.
17. Akbari, I. (2025, September 02). MITRE ATT&CK Framework as a Standard for Developing SIEM Use Cases. Available online: https://medium.com/@imanvanpersien/mitre-att-ck-framework-as-a-standard-for-developing-siem-use-cases-d7dc7db4e1ba.
18. Machine learning algorithms in SIEM systems for enhanced detection and management of security events
19. NIST (2022). Digital Forensics-Based Early Detection of Ongoing Cyber-Attacks (Fronesis), NIST.
20. Murphy, A. (2025, September 02). Inside a MITRE ATT&CK Evaluation: How CrowdStrike’s MDR Services Operate in the Real World. Available online: https://www.crowdstrike.com/en-us/blog/inside-mitre-attack-evaluation-how-crowdstrikes-elite-managed-services-operate-in-the-real-world/.
21. Tabassum, S., and Rahman, M.M. (2023). Digital and Cloud Forensic Challenges. arXiv.
22. Experts reviews of a cloud forensic readiness framework for organizations10.1186/s13677-019-0133-z ↗
23. Comparative Study of NIST SP 800-86 and ISO/IEC 27037 Standards as A Framework for Digital Forensic Evidence Analysis
24. Comparison Study of NIST SP 800-86 and ISO/IEC 27037 Standards as a Framework for Digital Forensic Evidence Analysis10.51519/journalisi.v6i2.717 ↗
25. Cloud forensics: Challenges and blockchain based solutions