登录查看更多内容

What are the best ways to dispose of incident evidence for an incident response team?

由人工智能和领英社区提供技术支持

When you are part of an incident response team, you need to know how to handle the evidence that you collect during an investigation. Evidence can include digital data, physical devices, logs, network traffic, and malware samples. Proper disposal of incident evidence is crucial for maintaining the integrity, confidentiality, and availability of your information security systems. In this article, you will learn what are the best ways to dispose of incident evidence for an incident response team.

此文章中的业界达人

由社区从 4 条内容中精选。了解更多

??? Grégory KOUNGA, CISSP, CISM

Penetration Testing | Operational Security
Ganesh S

Certified SOC ANALYST | Information security | Azure certified | Qradar | Cyber Threat Hunter | Virus total | Malware…

1 Follow a policy

The first step to dispose of incident evidence is to follow a policy that defines the roles, responsibilities, procedures, and standards for evidence collection, storage, analysis, and disposal. A policy should comply with the legal and regulatory requirements of your organization and industry, as well as the best practices and guidelines of the information security community. A policy should also specify the retention period, the disposal methods, and the documentation and reporting requirements for each type of evidence.

添加您的观点

Tirthankar Dutta

CIO & CISO Disney Star and Disney India at The Walt Disney Company | Forbes Technology Council Member | Top Information Security Voice | Top Risk Management Voice | Patent Holder | CISSP | CISA | CISM
举报内容
Proper disposal of incident evidence is crucial for maintaining the integrity of digital evidence and ensuring compliance with legal and regulatory requirements. Here are some best practices for disposing of incident evidence for an incident response team: Document Destruction Policy Data Classification Secure Deletion Methods Physical Destruction Chain of Custody Documentation By following these best practices, incident response teams can ensure that incident evidence is disposed of securely, maintaining its integrity and confidentiality while complying with legal and regulatory requirements.

已翻译

赞
ISHITA SONI

Business Analyst Intern | Product Management intern | Data Analytics intern | AI Solutions Pioneer | Collaborative Team Player | Excellence Driven | Passionate about AI
举报内容
As a student involved in incident response, use certified software for the complete deletion of digital evidence and adhere to your educational institution's procedures for the responsible disposal or recycling of physical devices, all while observing environmental regulations and legal mandates.

已翻译

赞

2 Secure the evidence

The second step to dispose of incident evidence is to secure the evidence until it is ready for disposal. This means that you should store the evidence in a locked and controlled environment, such as a safe, a cabinet, or a room, that is accessible only to authorized personnel. You should also use encryption, hashing, and digital signatures to protect the data from unauthorized access, modification, or deletion. You should also keep an inventory and a chain of custody record for each piece of evidence, to track its location, status, and history.

添加您的观点

??? Grégory KOUNGA, CISSP, CISM

Penetration Testing | Operational Security
举报内容
It is crucial to keep evidence safe and reliable. Secure storage environments with restricted access and surveillance, ensuring only authorized personnel can enter. Maintain detailed inventory and chain of custody records in a centralized system, updating them regularly with pertinent information like dates, times, and individuals who handled the evidence. Use encryption for data confidentiality and hashing algorithms for integrity during storage. Digital signatures authenticate evidence origin and integrity.

已翻译

赞

3 Erase the data

The third step to dispose of incident evidence is to erase the data from the digital devices and media that contain it. This means that you should use software tools or hardware devices that can overwrite the data with random or meaningless patterns, multiple times, until it is unrecoverable. You should avoid using simple delete or format commands, as they do not erase the data completely and can leave traces that can be recovered by forensic tools. You should also verify that the data has been erased successfully, by using software tools or visual inspection.

添加您的观点

Ganesh S

Certified SOC ANALYST | Information security | Azure certified | Qradar | Cyber Threat Hunter | Virus total | Malware Analysis | Firewall | Defender| Cyber Security Content writer
举报内容
Erasing the data is often one of the most vital tactics employed by attackers in the wild. By erasing the data it becomes easy for an attacker to maintain persistence for longer time as well as cover their tracks for lateral movement activities. Example attackers can use wevtutil.exe or vsadmin.exe to erase the logs. Similarly they can also use logman.exe that could ideally be used to exploit wevtutil.exe in a way that it won't record any logs.

已翻译

赞

4 Destroy the devices

The fourth step to dispose of incident evidence is to destroy the devices and media that store the data. This means that you should use physical methods, such as shredding, crushing, melting, or incinerating, to render the devices and media unusable and unrecognizable. You should also dispose of the devices and media in a secure and environmentally friendly way, such as using a certified recycling or disposal service. You should also document and report the destruction process and the disposal details.

添加您的观点

5 Delete the logs

The fifth step to dispose of incident evidence is to delete the logs that record the activities and events related to the evidence. This means that you should remove the logs from the systems and applications that generate and store them, such as servers, firewalls, routers, or antivirus software. You should also erase the logs from any backup or archive systems that may have copied them. You should also follow the same steps as erasing the data, to ensure that the logs are not recoverable.

添加您的观点

6 Sanitize the malware

The sixth step to dispose of incident evidence is to sanitize the malware that may have infected or compromised your systems or devices. This means that you should use antivirus software or other tools to scan, quarantine, and remove the malware from your systems or devices. You should also update your security software and patches, and change your passwords and settings, to prevent re-infection or further damage. You should also follow the same steps as erasing the data, to ensure that the malware is not recoverable.

添加您的观点

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Information Security

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

What are the best ways to dispose of incident evidence for an incident response team?

1

2

3

4

5

6

7

1 Follow a policy

2 Secure the evidence

3 Erase the data

4 Destroy the devices

5 Delete the logs

6 Sanitize the malware

7 Here’s what else to consider

Information Security

给文章评分

感谢您的反馈

更多Information Security相关文章

更多相关阅读内容

What are the best ways to dispose of incident evidence for an incident response team?

1

2

3

4

5

6

7

1 Follow a policy

2 Secure the evidence

3 Erase the data

4 Destroy the devices

5 Delete the logs

6 Sanitize the malware

7 Here’s what else to consider

Information Security

给文章评分

感谢您的反馈

查看其他技能