10:30 AM
Jason Sachowski
Jason Sachowski
Connect Directly
E-Mail vvv

How Digital Forensic Readiness Reduces Business Risk

These six real-world scenarios show how to turn reactive investigative capabilities into proactive, problem-solving successes.

Digital forensic investigations are, for the most part, still predominantly conducted in response to an incident. With this reactive approach, there is extreme pressure put on the investigation team to gather and process digital evidence before it is no longer available or has been modified. Showing signs of weakness, being reactive to incidents suggests that organizations are not acting on their own initiative to identify problem areas and develop strategies for its suppression.

For investigations to truly become proactive, organizations must closely examine the time, money, and resources invested into their overall investigative capabilities. Digital forensic readiness is a process used by organizations to maximize their electronically stored information (ESI) to reduce the cost of digital forensic investigations. At the starting point, there needs to be a breakdown of risks including both internal events -- those that can be controlled and take place within the boundaries of control (e.g. outages, human error) -- and external events -- those that cannot be controlled and take place outside the boundaries of control (e.g. floods, regulations). 

Here are six practical and realistic scenarios that can be used to demonstrate a pro-active initiative to manage business risk.

Scenario #1: Reducing the impact of cybercrime

With Information Technology (IT) playing an integral part of practically every business operation, the evolving threat landscape continues to increase risks associated with organizational assets. Using a threat modeling methodology, organizations can create a structured representation of the different ways a threat actor can go about executing attacks and how their tactics, techniques, and procedures can be used to create an impact. The output of this exercise can be put to practical use by implementing appropriate countermeasures that create potential digital evidence.

Scenario #2: Validating the impact of cybercrime or disputes

When a security incident occurs, organizations must be prepared to quantify impact. To obtain a complete and accurate view of the entire cost of an incident, both direct and indirect contributors must be included in the impact assessment. This means incorporating logs generated from different type of controls (e.g. preventive, detective, corrective) or the overhead cost of managing the incident (e.g. people and technology expenses).

Scenario #3: Producing evidence to support organizational disciplinary issues

A Business Code of Conduct document promotes a positive work environment that, when signed, strengthens the confidence of employees and stakeholders by establishing an accepted level of professional and ethical workplace behavior. When the guidelines set out in this document have been violated, employees can be subject to disciplinary actions. Where disciplinary actions escalate into a legal problem, organizations must approach the situation fairly and reasonably by gathering and processing credible digital evidence.

Scenario #4: Demonstrating compliance with regulatory or legal requirements

Compliance is not a one-size-fits-all process. It is driven by factors such as an organizations industry (e.g. financial services) or the countries where business is conducted (e.g. Canada). Evidence documenting that compliance standards are met must be specific to the requirements of both the regulation or law, and the jurisdiction.

Scenario #5: Effectively managing the release of court-ordered data

Regardless of how diligent an organization is, there will always be a time when a dispute ends up before a court of law. With adequate preparation, routine follow-ups, and a thorough understanding of what is considered reasonable in a court of law, organizations can effectively manage this risk by maintaining the admissibility of electronically stored information (ESI), such as the requirements described within the U.S. Federal Rules of Evidence. Ensuring compliance with these requirements demands that organizations implement safeguards, precautions, and controls to ensure their ESI is admissible in court and that it is authenticated to its original source.

Scenario #6: Supporting contractual and/or commercial agreements

From time to time, organizations are faced with disagreements that extend beyond disputes that involve employees. With the majority of today’s business interactions conducted electronically, organizations must ensure they capture and electronically preserve critical metadata about their third-party agreements. This would include details about the terms and conditions or the date the agreement was co-signed. Contract management system can be used to standardize and preserve metadata needed to provide sufficient grounds for supporting a dispute.

By following a reactive approach to digital forensic investigations, organizations foster a perception that they lack is initiative for managing risk.  Conversely, when organizations implement strategies to proactively gather potential sources of digital evidence in support of the business risk scenarios, they showcase their ability to effectively manage risk.

This article was sourced from the forthcoming book by Jason Sachowski, “Implementing Digital Forensic Readiness: From Reactive To Proactive Process,” available now at the Elsevier Store and other online retailers.

Jason is an Information Security professional with over 10 years of experience. He is currently the Director of Security Forensics & Civil Investigations within the Scotiabank group. Throughout his career at Scotiabank, he has been responsible for digital investigations, ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Author
12/15/2015 | 5:39:30 PM
Re: Scenario 6
@RyanSepe, we can't say that with 100% confidence in all instances. Depending on how an organization is setup (e.g. size, teams/departments, geography) the "business" aspect for each scenario can fall within the responsibility of any team/department, such as Legal or Contract Management, and the "technical" aspect with another, such as IT Support or Information Security. The scenarios called out in this article describe where digital evidence is required to realize benefits in managing risk. Generally speaking, if positive benefits can be realized by implementing digital forensic readiness for a scenario, then organizations should take a closer look into how pro-actively gathering digital evidence aligns with their business strategies for effectively managing risk.
User Rank: Ninja
12/14/2015 | 1:48:56 PM
Scenario 6
Could scenario 6 fall under the legal department's responsibilities?
User Rank: Strategist
12/11/2015 | 12:23:56 PM
User Activity and Behavior Monitoring in an Appliance
Great article, provides some very good insight.  I like that you've addressed some very good point.  I've worked in the past with an apliance based solution from Sergeant Laboratories called Arisotle Insight, Everyting logged to an appliance that can't be manipulated even by an adminstrator without opening the box phisically. That way you can meet some of your forensics information without hiring a expert on retainer and it also does a ton of other monitoring and anomoly detected, APT detction, overall tracking of internal user abuse etc.....  Ken
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/13/2018
10 Ways to Protect Protocols That Aren't DNS
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/16/2018
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2018-07-19
The approveAndCall function of a smart contract implementation for Aditus (ADI), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all contract balances into their account).
PUBLISHED: 2018-07-19
TP-Link WR840N devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses.
PUBLISHED: 2018-07-19
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code t...
PUBLISHED: 2018-07-19
Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
PUBLISHED: 2018-07-19
An exploitable heap overflow exists in the TIFF parsing functionality of Canvas Draw version 4.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and gain...