CO2517

Which of these is NOT part of the ACPO guidelines

•  That no action take is taken that should change data held on a digital device including a computer or mobile phone that may subsequently be relied upon as evidence in court

• Where a person finds it necessary to access original data held on a digital device that the person must be competent to do so and able to explain their actions and the implications of those actions on the digital evidence to a Court.

• That a trail or record of all actions taken that have been applied to the digital evidence should be created and preserved. An independent third party forensic expert should be able to examine those processes and reach the same conclusion.

• That the individual in charge of the investigation has overall responsibility to ensure that these principles are followed.

• The evidence must prove that there is a conviction of guilty

Answer explanation

There is no seeking to convict or nor bias throughout the investigation, you are seeking to discover evidence of an event and its associated data.

What is an Event?

• Anything that happens on our network

• Something that damages our network

• Anything that triggers a response from our servers

Answer explanation

Events happen all the time on networks and in life.

What is a Security Incident?

• Anything we believe might be on our network

• Only items that are logged as harmful

• Any event we know or suspect adverse to our network

• Only something defined in our Response Plan

A disruption of service on your network could be considered a

an authenticated student accessing their files via ssh, is a

A student logging into our system correctly could be considered either an incident or an event, which is it?

Malware could be considered either an incident or an event , which is it?

An incident ... (choose 2 answers)

• is a violation of our network

• always caused by outsiders

• could result in business loss

• always caused intentionally

Incident Responses are ... (choose 2 answers)

• Only react to issues

• Can have a proactive nature/affect

• Reduce Business Downtime

• Very Expensive

Put these stages of the Incident Response Process in the right order

• Preparation

• Containment Eradication & Recovery

• Detection & Analysis

• Post-Incident Activity