Our last topic of concern inside of managing security operations
would be the supporting of digital forensics.
When we think of digital forensics, ISO/IEC 27037,
the digital forensics guidance has three elements to it that include,
step 1, a prioritization plan to acquire the data.
We should be thinking about what the likely value is of the
data based on our understanding of the situation and our
previous experience in similar situations.
Here again, just as in incident management,
we need to have a preknowledge of what the information value is
and the corresponding impact and prioritization.
When we talk about volatility,
we're thinking about data that lives on a live system that
could be lost after that system is shut down,
terminated, or powered off.
A little bit different behavior in the cloud, but some of the same results.
Also we have to think of what's the amount of effort
required to acquire the different data sources?
Could vary widely.
So, effort involves not only the time spent by security professionals,
but also others in the organization.
That could be legal advisers and the like.
Step 2 is to acquire the data.
If the data has not already been acquired by security tools,
analysis tools, or other means,
the general process for acquiring the data involves using
forensics tools to collect volatile data.
Here again in the cloud creating a snapshot,
as we demonstrated earlier,
could be all that's necessary to capture everything needed,
but we need to make sure that we have this already specified based upon what
kind of data should travel or can travel across a network.
In step 3, we're verifying the integrity of the data.
After the data has been acquired, it should be verified.
It's particularly important to prove that the data has not been
tampered with because you may need this for legal reasons.
Data integrity verification typically consists of using tools to compute
the message digest based off of a hashing algorithm.
With forensics,
it can be complicated in the cloud based off of privacy
concerns that you may be mandated to follow,
provider dependencies when it comes to the localization of particular data,
who it is that is going to be responsible for the collection of the data,
the physical location of that data,
and also the trustworthiness of evidence based,
on part, on the cloud service provider.
Once the data is collected, evidence management,
we're thinking of keeping a detailed log of all the steps that have been taken.
In some cases,
those who are responsible as a custodian may end up taking
a photograph of the entire environment,
and it's really important to remember to maintain the chain
of custody by documenting everything.
The documentation should show a chronological order of who had access to it,
when was the data actually checked out, what the analysis process was,
and what the disposition of it is in case it needs to
be presented in the court of law.