What's the best way to protect incident response evidence?

Defining evidence scope is vital in incident response. It's like shining a spotlight in darkness — focusing on the critical and ignoring distractions. Remember: Incidents are dynamic; stay flexible in adjusting your scope as new info emerges. Ensure a strict chain of custody for evidence integrity. Digital evidence is time-sensitive; act swiftly. Always consider the incident's context. Seemingly unrelated data might hold clues. Clearly defined scopes streamline collaboration with external entities. Efficiently scoped evidence sets the tone for the entire response process.

Bare in mind that you might need evidence not only for technical reason, especially incident response but usually in other areas as well. Take care of legal and data protection requirements with regard to the evidence you are collecting as it is likely that you might present it in a legal context such as your notification requirements under Art. 33 GDPR. Usually the DPA want specific information on a incident where PII is involved.

Evidence scope is likely something that should be included in both an acceptable use policy (AUP) AND a separate personal device use policy. The separate policy question arises when a company issues personal devices for employees to use. Many standard policies do not address the infrastructure and data-related risks when company assets are accessed and processed via a personal device (especially one that is company-issued). Even though there may be no expectation of privacy since the device is company-owned, policy should take steps to ensure that any personal data on the device (for example, text messages outside of work hours) be excluded from any evidence that is gathered. See Ontario vs Quon (2010) for the rest of the story.

Identify the specific types of evidence needed, such as logs, files, or network data, and their locations to prioritize the most pertinent sources. This targeted approach prevents resource waste and ensures focus on data directly related to the incident. Document your scope and criteria thoroughly, and communicate them clearly to your team and stakeholders. This strategy promotes consistency, transparency, and efficiency, enabling a more streamlined and relevant investigation process.

The chain of custody ensures evidence remains pristine and defensible. Compare it to a relay race; if one runner mishandles the baton, the entire team's effort is jeopardized. In a real-world example, a breach at a financial institution led to a lawsuit. They had documented evidence of unauthorized access but failed in maintaining a strict chain of custody. Logs were mislabeled, and it wasn't clear who accessed them and when. This lapse provided the opposing counsel room to question evidence integrity, casting doubt on its authenticity. The lesson? Without meticulous adherence to the chain of custody, even solid evidence can become a liability.

Every step from collection to storage must be meticulously documented, with detailed records of who handled the evidence, when, and for what purpose. Implement secure, standardized procedures for labeling, storing, and transferring evidence to prevent tampering or loss. An unbroken chain of custody not only upholds the evidence's credibility but also fortifies the investigation against legal challenges. Precision in these practices underpins the effectiveness and legitimacy of forensic processes.

Forensic tools are the digital detectives of the cyber realm. Imagine a company with a compromised server; with forensic imaging, they can duplicate and investigate without disruption. This "cloning" reveals the intricate paths of malware and data breaches. Similarly, when internal data theft occurs, these tools scan vast logs, pinpointing unauthorized transfers. It's like having CCTV footage in a heist. And when results need explaining? Forensic presentation tools turn complex data trails into understandable narratives, aiding decisions. In essence, these tools are the unsung heroes, turning the overwhelming digital crime scene into decipherable stories.

Look at your network as a forensic tool. If you don't have a "black hole" subnet (e.g. a non-routable VLAN), ask your operations colleagues to create one for you. Now, when a device appears compromised, you are not required to disconnect the suspect device before starting your investigation. Ask instead that it be placed in the "black hole"...this can trick any possible malware into believing it is still connected and, as a result, remain running. Most network protocols have a keepalive function; they try to establish and maintain connections for a period of time before the session is torn down. By leveraging this, the investigator has the luxury of being able to capture actionable incident data from the point of concern before it is lost.

Forensic imaging tools create exact replicas of data sources, safeguarding the original state and enabling detailed examination without alteration. Analysis tools, such as log extractors and malware analyzers, delve into diverse data sets to uncover critical insights and patterns. Presentation tools further enhance this process by structuring findings clearly and effectively for stakeholders. Leveraging these specialized tools ensures that evidence remains reliable and actionable, reinforcing the credibility of forensic investigations.

Encrypt incident response evidence both in transit and at rest to protect it from unauthorized access or interception. Use strong encryption algorithms and ensure that encryption keys are securely managed and only accessible to authorized personnel. Implement measures to verify the integrity of incident response evidence, such as digital signatures or checksums. Regularly verify the integrity of evidence throughout the investigation process to detect any tampering or corruption. Make regular backups of incident response evidence to protect against data loss or corruption. Store backups in secure locations with restricted access to ensure their availability for future reference or analysis.

Be especially wary here if any evidence gathered is involved in a child pornography case. You may be authorized to gather and inspect the data that you turn over to law enforcement, but the data itself and any copies need to be disposed of in accordance with existing policy. Or else you may be a subject in the next investigation.

Part of the answer here is jurisdiction dependent. If you need to preserve copies of documents for potential litigation, always take the advice of a lawyer in that jurisdiction. In some jurisdictions you can simply present copies of documents in court and with the appropriate notice, they will be accepted. In other jurisdiction's, a witness may need to attend to testify to the source of the documents or that hand written records were made by them. Lastly, in some civil code jurisdictions, copying of documents may have to be done before a notary and certified by that notary as true copies before a court will accept them.