Forensic Techniques: Helping Organizations Improve Their Responses to Information Security Incidents

This bulletin explains the need for the use of digital forensic techniques, which can help organizations respond more effectively to information security incidents, and protect the confidentially, integrity and availability of their information and systems. While generally associated with law... See full abstract

This bulletin explains the need for the use of digital forensic techniques, which can help organizations respond more effectively to information security incidents, and protect the confidentially, integrity and availability of their information and systems. While generally associated with law enforcement, forensic techniques also play an important role in an organization?s comprehensive information security activities. Digital forensic techniques support the investigation of crimes and violations of internal policies, analyses of security incidents, review of operational problems, and recovery from accidental system damage. Topics covered in the bulletin include the need for digital forensics, the forensics process, and the role of forensics in the system development life cycle. NIST recommendations for establishing, organizing and using forensics techniques are summarized.
Hide full abstract