System Forensics, Investigation, and Response, 3rd Edition

Adding Forensics to Incident Response

Realizing the importance of forensics in incident response is an important first step. But this realization still leaves the question of how to implement proper forensic procedures. There are specific steps that an IT department can take to intertwine forensic techniques with the company’s incident response policies.

Forensic Resources

The first step is to identify forensic resources that the organization can utilize in case of an incident. No amount of policy change will be effective if the company does not have access to forensically trained individuals. One approach an organization can take is to get basic forensic training for its own IT security staff. Many computer-related college degrees now ...