Finding evidence
As soon as you discover an attack, there are a lot of things that need to be done with the utmost priority, including restoring the systems and services that have been impacted. However, another critical task is to find and secure all the evidence related to the attack. This task is critical as it allows you to do the following:
- Determine whether the attack was executed by an insider or outsider.
- Determine whether the insider was a malicious insider or an inadvertent user.
- Determine the vulnerability exploited by the attacker.
- Determine the impact on business data in terms of the confidentiality, integrity, and availability (CIA) triad.
- Determine the systems or services impacted by the attack.
- Collect evidence to execute legal or corrective actions (from HR).
Now that you know about the importance of collecting evidence, let's look at some best practices regarding the collection process itself.
Sources of data
As you may...
