esj.com/articles/2005/10/25/forensic-contingency-planni -
[Cached Version]
Published on: 10/25/2005
Last Visited: 3/10/2009
To help, the IAAC released a new report, “Directors and Corporate Advisors’ Guide to Digital Investigations and Evidence,†written by Peter Sommer, a senior research fellow at the London School of Economics.
In the report, Sommer advocates organizations maintain a forensic readiness program, and details how organizations should gather and preserve evidence.
He notes the limitations of surveillance, which laws companies must beware of, and exactly how evidence-gathering fits into a security incident-response plan.
Creating a Forensic Readiness Program
A forensic readiness program helps organizations retain and process any data they might need to investigate breaches, assist in criminal cases, or solve legal disputes.
Creating such a program doesn’t require training and retaining a crack staff of digital forensics experts. “Most businesses and individuals don’t need to have on their staff a digital Sherlock Holmes, but they should have plans to identify and preserve important digital evidence such as e-mail, Web transactions, PCs, PDAs, and cell phones, and have a broad understanding of some of the associated legal problems such as admissibility and privacy,†says Sommer.
Another reason to have a forensic program is that organizations are sometimes required to produce digital evidence, regardless of whether they have a well-functioning forensic program in place.
In fact, “nearly all organizations underestimate how often they may be called on to produce reliable evidence of what has happened in and around their information and communication technology systems,†he says. “They also underestimate the demands that the legal system makes in terms of ensuring the admissibility and reliability of digital evidence.†The failure or inability to comply with such requests “can have a profound impact on business welfare.â€