Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know.
Whether it's your first investigation or 500th, review the basics of IT forensics to streamline and simplify your discovery.
July 17, 2019
Most infosec forensics investigators walk a fine line. They must adhere to specific institutional processes, which, in many cases, are state and federal requirements. But they must also use a certain amount of pragmatism since no two investigations are exactly alike.
So while there may be a corporate best practice of collecting log files from all systems, that approach doesn't make sense if what you need is a single line of code from a log file to get you to the next level of the investigation, explains Richard Rushing, CISO of Motorola Mobility.
"I need to know if this user account logged into that server. And that information may already be somewhere else that doesn't require me to go through all the log files," he says. "That's the sort of thing people overlook sometimes." Process and pragmatism can work in tandem to help peel back the layers, Rushing adds.
With that in mind, here are 10 tips and refreshers for forensics pros working on IT incidents, suspected or real.
About the Author(s)
You May Also Like
Guarding the Cloud: Top 5 Cloud Security Hacks and How You Can Avoid Them
April 4, 2024Cybersecurity Strategies for Small and Med Sized Businesses
April 11, 2024Defending Against Today's Threat Landscape with MDR
April 18, 2024Securing Code in the Age of AI
April 24, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024Black Hat Asia - April 16-19 - Learn More
April 16, 2024