Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:30 AM
Jason Sachowski
Jason Sachowski
Connect Directly
E-Mail vvv

How ‘Digital Forensic Readiness’ Reduces Business Risk

These six real-world scenarios show how to turn reactive investigative capabilities into proactive, problem-solving successes.

Digital forensic investigations are, for the most part, still predominantly conducted in response to an incident. With this reactive approach, there is extreme pressure put on the investigation team to gather and process digital evidence before it is no longer available or has been modified. Showing signs of weakness, being reactive to incidents suggests that organizations are not acting on their own initiative to identify problem areas and develop strategies for its suppression.

For investigations to truly become proactive, organizations must closely examine the time, money, and resources invested into their overall investigative capabilities. Digital forensic readiness is a process used by organizations to maximize their electronically stored information (ESI) to reduce the cost of digital forensic investigations. At the starting point, there needs to be a breakdown of risks including both internal events -- those that can be controlled and take place within the boundaries of control (e.g. outages, human error) -- and external events -- those that cannot be controlled and take place outside the boundaries of control (e.g. floods, regulations). 

Here are six practical and realistic scenarios that can be used to demonstrate a pro-active initiative to manage business risk.

Scenario #1: Reducing the impact of cybercrime

With Information Technology (IT) playing an integral part of practically every business operation, the evolving threat landscape continues to increase risks associated with organizational assets. Using a threat modeling methodology, organizations can create a structured representation of the different ways a threat actor can go about executing attacks and how their tactics, techniques, and procedures can be used to create an impact. The output of this exercise can be put to practical use by implementing appropriate countermeasures that create potential digital evidence.

Scenario #2: Validating the impact of cybercrime or disputes

When a security incident occurs, organizations must be prepared to quantify impact. To obtain a complete and accurate view of the entire cost of an incident, both direct and indirect contributors must be included in the impact assessment. This means incorporating logs generated from different type of controls (e.g. preventive, detective, corrective) or the overhead cost of managing the incident (e.g. people and technology expenses).

Scenario #3: Producing evidence to support organizational disciplinary issues

A Business Code of Conduct document promotes a positive work environment that, when signed, strengthens the confidence of employees and stakeholders by establishing an accepted level of professional and ethical workplace behavior. When the guidelines set out in this document have been violated, employees can be subject to disciplinary actions. Where disciplinary actions escalate into a legal problem, organizations must approach the situation fairly and reasonably by gathering and processing credible digital evidence.

Scenario #4: Demonstrating compliance with regulatory or legal requirements

Compliance is not a one-size-fits-all process. It is driven by factors such as an organizations industry (e.g. financial services) or the countries where business is conducted (e.g. Canada). Evidence documenting that compliance standards are met must be specific to the requirements of both the regulation or law, and the jurisdiction.

Scenario #5: Effectively managing the release of court-ordered data

Regardless of how diligent an organization is, there will always be a time when a dispute ends up before a court of law. With adequate preparation, routine follow-ups, and a thorough understanding of what is considered reasonable in a court of law, organizations can effectively manage this risk by maintaining the admissibility of electronically stored information (ESI), such as the requirements described within the U.S. Federal Rules of Evidence. Ensuring compliance with these requirements demands that organizations implement safeguards, precautions, and controls to ensure their ESI is admissible in court and that it is authenticated to its original source.

Scenario #6: Supporting contractual and/or commercial agreements

From time to time, organizations are faced with disagreements that extend beyond disputes that involve employees. With the majority of today’s business interactions conducted electronically, organizations must ensure they capture and electronically preserve critical metadata about their third-party agreements. This would include details about the terms and conditions or the date the agreement was co-signed. Contract management system can be used to standardize and preserve metadata needed to provide sufficient grounds for supporting a dispute.

By following a reactive approach to digital forensic investigations, organizations foster a perception that they lack is initiative for managing risk.  Conversely, when organizations implement strategies to proactively gather potential sources of digital evidence in support of the business risk scenarios, they showcase their ability to effectively manage risk.

This article was sourced from the forthcoming book by Jason Sachowski, “Implementing Digital Forensic Readiness: From Reactive To Proactive Process,” available now at the Elsevier Store and other online retailers.

Jason is an Information Security professional with over 10 years of experience. He is currently the Director of Security Forensics & Civil Investigations within the Scotiabank group. Throughout his career at Scotiabank, he has been responsible for digital investigations, ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Author
12/15/2015 | 5:39:30 PM
Re: Scenario 6
@RyanSepe, we can't say that with 100% confidence in all instances. Depending on how an organization is setup (e.g. size, teams/departments, geography) the "business" aspect for each scenario can fall within the responsibility of any team/department, such as Legal or Contract Management, and the "technical" aspect with another, such as IT Support or Information Security. The scenarios called out in this article describe where digital evidence is required to realize benefits in managing risk. Generally speaking, if positive benefits can be realized by implementing digital forensic readiness for a scenario, then organizations should take a closer look into how pro-actively gathering digital evidence aligns with their business strategies for effectively managing risk.
User Rank: Ninja
12/14/2015 | 1:48:56 PM
Scenario 6
Could scenario 6 fall under the legal department's responsibilities?
User Rank: Strategist
12/11/2015 | 12:23:56 PM
User Activity and Behavior Monitoring in an Appliance
Great article, provides some very good insight.  I like that you've addressed some very good point.  I've worked in the past with an apliance based solution from Sergeant Laboratories called Arisotle Insight, www.aristotleinsight.com. Everyting logged to an appliance that can't be manipulated even by an adminstrator without opening the box phisically. That way you can meet some of your forensics information without hiring a expert on retainer and it also does a ton of other monitoring and anomoly detected, APT detction, overall tracking of internal user abuse etc.....  Ken
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...