THANK YOU FOR SUBSCRIBING
Enterprise Security Magazine | Wednesday, December 15, 2021
Organizations should have written information security policies before a breach happens. They should enforce them throughout their business to ensure they follow industry best practices for information security.
Fremont, CA: The pieces on the table begin to show a picture based chiefly on what isn't in a data log to a top-notch investigator. If a corporation implemented digital forensics best practices before the incident, they could easily pinpoint what's missing. A smart digital forensics investigator understands the importance of looking for gaps. When steps in an expected chain of events go missing, good investigators spot red signs.
Why missing data is a problem for digital forensics
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
Investigators may not witness the user log in, but they may see the user log out. This causes them to wonder what happened. Was there a problem with the system? Has the user been signed in for an extended period of time, implying that an attack may have occurred outside of the brief window they're viewing? Missing logins/logouts, for example, raise extra questions: Is there any more crucial information that the hacker has wiped out? Is there a lack of normal day-to-day activities? That looks like a jungle to an observant investigator, where the birds have gone silent, implying that a panther could be lurking somewhere down there.
To solve this, Digital forensics must prepare in advance
The company should consult with a digital forensics team ahead of time about the kind of data and audit logs they'd like to view during an investigation. Many important tracking settings are enabled by default on Windows and Linux, but they won't catch the accurate representation. On the other hand, tracking everything on the network would result in an inaccessible deluge of information. As a result, it's vital to make prior decisions regarding what to track.
An organization can know what should appear in an audit log if they create a profile ahead of time. If any of the pieces are missing, they can assume that their system failed or that someone tampered with the log to conceal their actions.
More in News