IMF 2006
International Conference on
IT-Incident Management & IT-Forensics

October 18 - 19, 2006
Stuttgart, Germany

Conference of SIG SIDAR
of the German Informatics Society (GI).

*** Deadline for Paper submission EXTENDED to May 1st, 2006 ***

[Start page]    [Conference Program]    [Contact]

Call for Papers

Information technology has become crucial to almost every part of society. IT infrastructures have become critical in the world-wide economy, the financial sector, the health sector, the government's administration, the military, and the educational sector.

Due to its importance the disruption or loss of IT capabilities results in a massive reduction of operability. Hence, IT security is continously gaining importance.

Although security usually gets integrated into the design process of IT systems nowadays, the process of maintaining security in the operation of IT infrastructures still lacks the appropriate attendance in most cases. Especially the capability to manage and respond to IT security incidents and their forensic analysis is established in the rarest cases. The quickly rising number of security incidents worldwide makes the implementation of incident management capabilities essential.

In order to advance the fields of IT-Incident Management and Forensics the special interest-group Security - Intrusion Detection and Response (SIDAR) of the German Informatics Society (GI) organises an annual conference, bringing together experts from throughout the world, to discuss state of the art in the areas of Incident Management and IT-Forensics (IMF). IMF promotes collaboration and exchange of ideas between industry, academia, law-enforcement and other government bodies.

IMF invites to submit:

  • Full papers of up to 20 pages, presenting novel and mature research results. Full papers will be reviewed, and papers accepted for presentation at the conference will be included in the proceedings.
  • Practice papers of up to 12 pages, describing best practices, case studies, lessons learned, or latest product developments. Practice papers will be reviewed.
The papers will be reviewed, and papers accepted for presentation at the conference will be included in the proceedings, which are planned to appear in Springer's Lecture Notes in Computer Science (LNCS) series (approval pending).

The scope of IMF 2006 is broad and includes, but is not restricted to the following areas:

IT-Incident Management:

  • Purposes of IT-Incident Management
  • Trends, Processes and Methods within IT-Incident Management
  • Formats and Standardisation in the IT-Incident Management
  • Tools for the IT-Incident Management
  • Education and Training in the field of IT-Incident Management Awareness
  • Determination, Detection and Evaluation of Incidents and Sensors
  • Procedures for Handling Incidents
  • Problems and Challenges while establishing CERTs/ CSIRTs
  • Sources of Information/ Information Exchange/ Communities
  • Dealing with Vulnerabilities (vulnerability response)
  • Current Threats
  • Early Warning System
  • Organisations (Nat. CERT-Associations, FIRST, TERENA/ TI, TF-CSIRT)
  • Trends and Challenges within IT-Forensics
  • Methods, Processes and Applications for IT-Forensics ( Networks, Operating Systems, Storage Media, ICT-Systems etc.)
  • Evidence Protection in IT-Environments
  • Standardisation of Evidence Protection Processes
  • Data Protection- and other legal implications for IT-Forensic Investigations
  • Juristic Relevance of IT-Forensic Investigations
  • Tools for IT-Forensics
  • Forensic readiness


General chair:Dirk Schadt, CA, Germany, (dirk.schadt @
 Hardo G. Hase, IT-Consulting Hardo G. Hase, Germany
 Sandra Frings, Fraunhofer IAO, Germany
 Oliver Goebel, RUS-CERT, Stuttgart University, Germany
 Detlef Guenther, Volkswagen AG, Germany
 Jens Nedon, Consecur GmbH, Germany
Program Chair: Oliver Goebel, RUS-CERT, Stuttgart University, Germany,
goebel @
Sponsor Chair: Dirk Schadt, CA, Germany,
dirk.schadt @


Henrik Becker Kanzlei Becker, Germany
Vlasti Broucek University of Tasmania, Australia
Ian Bryant NISCC, UK
Brian Carrier CERIAS, USA
Andrew Cormack JANET CERT, UK
Herve Debar France Telecom, France
Ralf Dörrie Telekom CERT, Germany
Maximilian Dornseif University of Mannheim, Germany
Ulrich Emmert esb Rechtsanwälte Stuttgart, Germany
Günther Ennen BSI/CERT-Bund, Germany
Christoph Fischer BFK-Consulting, Germany
Sandra Frings Fraunhofer IAO, Germany
Oliver Göbel RUS-CERT, Germany
Dieter Gollmann TU Hamburg-Harburg, Germany
Detlef Günther Cert-VW, Volkswagen AG, Germany
Bernhard Hämmerli ACRIS GmbH, Switzerland
Hardo G. Hase IT-Consulting Hardo G. Hase, Germany
Mark Hoestra IT Forensic BV, Netherlands
Klaus Peter Kossakowski   DFN-CERT, Germany
Thorsten Lieb Avocado Rechtsanwälte Frankfurt, Germany
Neil Mitchison Joint Reseach Centre, EU
Jens Nedon Consecur GmbH, Germany
Jason Rafail CERT/CC, USA
Damir Rajnovic CISCO-PSIRT, USA
Dirk Schadt CA, Germany
Christian Schaller SIEMENS-CERT, Germany
Rolf Schulz gnsec, Germany
Marco Thorbruegge IT Security Expert, Germany
Helmut Ujen Bundeskriminalamt, Germany
Andreas Wagner Frontrunner FZ LLC, Du
Stephen Wolthusen Gjovik University College, Norway


  • April 17, 2006: Deadline for submission of full and practice papers.
  • June 19, 2006: Notification of acceptance or rejection.
  • August 7, 2006: Final paper camera ready copy due.
  • October 18-19, 2006: IMF 2006 conference.

    Paper submissions are accepted via the START conference manager only. Please use the following link:

    All submissions must be in English, and in either postscript or PDF format.

    Submitted full papers must not substantially overlap papers that have been published or that are simultaneously submitted to a journal or a conference with proceedings.

    Accepted papers must follow the format of Springer LNCS ( ) series. Guidelines and templates for manuscript preparation can be found at the Springer's Information for LNCS Authors site,11855,5-164-2-72376-0,00.html (please use instructions for "Proceedings and Other Multiauthor Volumes" for different text processing platforms).

    Submissions must be made via the "IMF-2006 Paper Submission Site"


    We solicit interested organizations to serve as sponsors for IMF 2006; please contact the Sponsor Chair, Dirk Schadt, for information regarding corporate sponsorship (mailto:

    Imprint / Impressum