One of the best qualities an information technology (IT) professional can possess is the tenacity to fully troubleshoot and resolve system issues as they occur. Unfortunately, that same drive and sense of urgency to gather relevant facts and to restore inoperable systems as quickly as possible can create issues for the necessary digital forensic investigations following a data security incident.
It is vitally important for both in-house IT professionals and managed services providers to understand that digital forensic experts can support the process of restoring impacted systems. It is equally important for in-house IT professionals and managed services providers to view digital forensics experts not as a threat to the intrinsic value of their work but as a resource in accomplishing their goals. Indeed, forensic science – like the study of genetics or chemical engineering – is incredibly complex and requires significant time and effort to master. In many instances, the best practitioners have backgrounds in law enforcement and thus have the training necessary to review piles of evidence to determine what happened and how to prevent future attacks.
When a data security incident is discovered, impacted companies should consult with digital forensic experts immediately and include such experts in the process of investigating, containing, and remediating an incident. Digital forensic experts can ensure that critical data from impacted systems are preserved for review and analysis prior to the start of any remediation efforts that may impact the availability of such data. The legal team and the insurance carrier representing an organization that has experienced a data security incident rely heavily on accurate forensic evidence in order to limit economic damages and properly address any compliance issues.
Advances in forensic technology occur at a rapid pace as new attack vectors are continually discovered, often rendering monitoring and recovery tools obsolete shortly after their debuts on the market. This, along with the proliferation of mobile devices with their constantly changing security protocols, adds to the overall complexity of investigating sophisticated digital attacks. Digital forensics experts are perfectly positioned to advise companies in this ever-changing landscape.
The long-term cost in tools and training to develop and retain forensic skills in-house is a difficult choice to make given tight corporate budgets, especially when those skills may not be used often enough moving forward to justify the original investment. Just as critically, devoting internal IT resources to complex and lengthy digital forensic investigations pulls those valued professionals away from their primary mission: supporting the 24/7 effective utilization of system resources.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.