US Air Force Cyber Chief Says Digital Forensics Needs More Investment to Keep Pace with Threats

Speaking at the Datadog Threat Response Forum, produced by FedScoop, Wanda Jones-Heath, principal cyber adviser for the US Department of the Air Force, said the government needs to invest in digital forensics. She said it helps teams detect incidents, hunt for where they started, and work out who was responsible and where they came from. Forensics usually happens after the fact, looking at events weeks or months later, so the challenge is keeping pace with incidents as they unfold. Once an incident is identified, she said, teams can partition the areas still under attack while continuing to operate.

Jeffrey Hunt of the Department of Defense Cyber Crime Center said the divide between operations and security teams over visibility into network threats should be tackled early. He warned that merging the two into one big unit is a "disaster" that does not work. Instead, he suggested a liaison arrangement, with someone from security in the room from the start of operational planning.

Jones-Heath also called for changes to cyber exercises. She said the aim is to avoid being in "reactive mode" and to know what to do when "data is poisoned". Current exercises are not typically designed around how teams would operate during real engagement, she said, so cyber teams should be involved on both the offensive and defensive side.