Towards a Computer Forensics Curriculum

1
Towards a Computer Forensics Curriculum

• Alastair Irons
• Northumbria University

2
Objectives

• Set the scene
• Start discussions on curriculum
• Introduce Workshop 1

3
Computer Forensics as a Subject

• As a branch of forensic science
• As a branch of computer science
• a sub discipline of computer science
• A relative discipline of computer security
• As an interdisciplinary subject
• For example linked to computer science, forensic
  science, law and criminology
• As a discipline in its own right

4
Purpose of Computer Forensics Programmes

• To develop skilled professionals in computer
  forensics in order to address employability?
• To develop a bottom up or top down approach to a
  specific branch of computing
• To provide a course which will attract different
  students to computing schools?
• To contextualise computer science (see Irons and
  Laing 2006) ?

5
What makes a Computer Forensics Programme

• No generally accepted curriculum
• No benchmark
• No professional body syllabus
• Undergraduate programmes
• Specialist module in final year ?
• Thread running through all levels (20 points per
  level)
• Development of a practical and theoretical body
  of knowledge from year 1 to final year (20, 40,
  40 plus project)
• Role of joint programmes criminology or
  forensic science or law ???
• Postgraduate programmes
• Specialist or generalist ?
• Stand alone or linked to security ?

6
Towards a Computer Forensics Curriculum

• Technical expectations and requirements
• Practical application
• Balance between theory and practice
• Theoretical underpinning
• different to computer science ? (explored in
  workshop 2)
• Legal and ethical requirements ?
• Particular pedagogic requirements
• Problem based learning, authentic learning ???
• Specialist subject based research
• Resource requirements
• Should curriculum be linked to accreditation and
  licence to practice

7
Further Reading

• Irons, A.D. Laing, C., and Anderson, P., (2006)
  Computer Forensics a Case Study on the Impact
  of New Technology on Informatics Education,
  paper presented at Informatics Education Europe,
  Montpelier, France, November 8 9, 2006
• Dornseif, M., Freiling, F. C., Holz, T., Irons,
  A. D., Laing, C., Mink, M., and Anderson P.,
  (2006) Comparative Study of Teaching Forensics
  at a University Degree Level, IMF 2006,
  International Conference on IT-Incident
  Management IT-Forensics, October 18 - 19, 2006
  Stuttgart, Germany
• Irons, A. D., Laing, C., Anderson, P., (2006)
  Pedagogic Innovation in Teaching Computer
  Forensics, paper presented at 7th Annual HE
  Academy Conference for Subject Centre for
  Information and Computer Sciences, Trinity
  College, Dublin, 29 31st August 2006
• Irons, A. D., Laing, C., Dornseif, M., Freiling,
  F., Anderson, P., Holz, T., Mink, M., (2006)
  Developing Computer Forensics Programmes An
  International Perspective, 1st Conference on
  Advances in Computer Security and Forensics
  (ACSF), School of Computing and Mathematical
  Sciences, Liverpool John Moores University,
  Liverpool, UK 13-14 July, 2006
• Staley, A. B., Inch, S., and Shapeero, M., (2006)
  From CSI to classroom developing a computer
  forensics degree program, in Information Systems
  Control Journal, pp 39 43

8
Workshop 1 What makes a computer forensics
programme a computer forensics programme ?

• What do we need to cover in a computer forensics
  curriculum ?
• Are there a minimum number of computer forensics
  credits required before an award can be titled
  computer forensics ?
• Is there a minimum expectation in the computer
  forensics skill-set, application and / or
  knowledge ?
• What should the balance between theory and
  application be ?
• Flexibility to embrace advances in digital
  forensics ?
• What chapters would you expect to have in a
  textbook covering computer forensics ?