Root cause analysis/investigation/forensic analysis of crisis, acquisition and retention of evidence and logs are necessary from legal point of view. Collection of evidence needs to be efficient so that the bank should not face any legal complexity during further investigation. The below guidelines need to be followed to avoid legal complexity.
Top 7 Things to do:
- Affected every electronic evidence will be preserved on an as is basis, to ensure its integrity.
- Any actions that may suggest tampering of evidence will be avoided.
- Every action (including symptoms of the problem) pertaining to the evidence will be thoroughly and unambiguously documented. This ensures that the scope for challenging the data, by resorting to multiple interpretations, is reduced.
- Decision makers will be intimated about the evidence available as soon as possible. This is important to avoid charges of fabrication of evidence.
- Access to the evidence should be strictly controlled. This is important in order to substantiate the claim that the logs are tamper-proof.
- Movement of evidence will be tracked. A detailed list of 15 individuals who control the evidence at any point will be maintained. The list will provide details with respect to date of receipt of the evidence, location where evidence is received, reason for handing over the evidence to the individual, period for which evidence is retained by the individual, etc.
- Before shutting down the system containing the evidence, all data with respect to messages on the screen, memory contents, state of network connections, state of running processes will be noted provided it is absolutely necessary.
Things Not to Do:
The following mistakes are to be avoided when handling evidences:
- Altering time and date stamps on evidence systems before recording them.
- Terminating rogue processes.
- Patching the system before investigators respond.
- Not recording the commands executed on the system.
- Using untrusted commands and binaries.
- Writing over potential evidence by installing software on the hard drive.
>>Get the Complete Report on Crisis Management Plan (Banking Industry)
Comments