Tag: Forensics Readiness

When we plan our incident response strategies and forensic readiness steps, we strongly pay attention to digital evidence acquisition, storage, handling, reporting, and remediation. While these stages are of essential importance for the overall cyber posture of your organization it is more than important as well, throughout each of these steps, to include legal risks and considerations. 

The purpose of an investigation is never just to find the source of damage and place a quick repair. An investigation is in place to find out how it happened, document it, and fix those circumstances so they don’t occur again.

The end goal of this step is to ensure that internal training & awareness programs take place within your organization since your employees may be involved in the process of handling security incidents. 

Being agile in dealing with, and handling, digital evidence is of great use when an incident happens. It is helpful to have a document that will clearly state the types of digital evidence required by a court or your internal compliance department, and how to collect them. Applying strategies to achieve forensic readiness shows that an organization has the initiative and ability to manage risks effectively.

Throughout the digital evidence collection process all actions have to be taken in a secure manner. In the previous step we covered how to ensure that digital evidence is collected in a secure way, using appropriate tools, so the authenticity of the digital record is not compromised. In this article we will cover the steps on how to secure digital evidence, once it is collected, for the longer term in accessing your forensic readiness posture.