Digital Forensics, Investigation, and Response 5E, 5th Edition

Adding Forensics to Incident Response

Realizing the importance of forensics in incident response is an important first step. But this realization still leaves the question of how to implement proper forensics procedures. There are specific steps that an IT department can take to intertwine forensic techniques with the company’s incident response policies.

Forensic Resources

The first step is to identify forensic resources that the organization can utilize in case of an incident. No amount of policy changes will be effective if the company does not have access to forensically trained individuals. One approach an organization can take is to get basic forensics training for its own IT security staff. Many computer-related college degrees now ...