Implementing Digital Forensic Readiness

Chapter 11

Map Investigative Workflows

Abstract

All suspicious events detected throughout the organization must be reviewed to determine the impact and the potential risk to business operations. In every instance, depending on the level of risk identified, a decision needs to be made for how different incidents will be handled throughout the organization.

Keywords

Escalation; Incident management; Investigative workflow; Roles and responsibilities

 

This chapter discusses the seventh step for implementing a digital forensic readiness program as the need to establish the workflows for handling different types of investigations throughout the organization. Whether an incident has been detected through proactive security monitoring or by human watchfulness, ...