4 crime scene mistakes that can sink a cyberforensic investigation

It’s easy to see how forensics used during a cyberattack investigation are similar to those used in a physical crime scene. In both cases, the evidence must be secured and handled properly, and photographs or images must be taken to capture how the crime scene was originally found. Network traffic and application scans can reveal as much as fingerprints and blood spatter do.

But, the similarities don’t end there. There are common mistakes that detectives can make when they investigate a crime scene. Avoiding similar mistakes when there is a security breach can serve as a guide for IT cyberforensics professionals, as well.

Mistake #1: Inadequate crime scene preservation

Immediately assessing the state of a crime scene, defining its boundaries and limiting who can enter all are important elements in crime scene preservation. Failure to follow any of these steps can result in missing or compromising evidence. The same is true of a cybercrime scene situation.

First things first: Investigators must assess the severity of the attack. What information has been compromised? How long has the attack been going on? In addition, it’s important to assess what evidence is volatile data and what information is persistent or non-volatile data. Volatile data is compromised when a system is powered off.  Be careful not to disrupt metadata by opening, saving or printing files. Likewise, take measures so that caches are not changed and temporary files are not altered.

Mistake #2: Missing the one chance for picture perfect

Detectives have only one chance to photograph an undisrupted crime scene during their initial approach. Forensic imaging is equally important to discovering the root cause of and remediating cyberattacks. All of the targeted system’s data must be captured and retained on a separate storage device. This preserves the state of the system at the time the incident occurred, so that if system changes are made after the investigation begins, the exact image of the breached network is preserved for analysis.

Mistake #3: Lack of communication

In a physical crime scene, communication needs to take place between the investigating detective, the coroner, the pathologist, the crime lab scientists and others. Each step of the investigation requires communication between multiple groups. Failure to communicate clearly could lead to problems with the disposition of the investigation at a later date.

Communication is equally important in cyberforensics, and that communication extends far beyond the designated chief security officer and the security team. Centralized IT teams must be involved to provide knowledge about the application and network environment that is under investigation. In addition, senior management requires frequent communication to continuously assess the impact of the security breach on the business.

A communications professional can assess and protect against the organization’s reputation being damaged, as well as report information to stakeholders on a timely basis. Cyberforensics involves the delicate balance of communicating promptly and frequently with taking the time necessary to uncover the facts. Providing information too quickly that later proves to be inaccurate could compromise the team’s credibility and its ability to effectively manage the breach.

Mistake #4: Not having plans, policies and rules

What’s the standard operating procedure? This question can plague physical crime scene investigators and cybercrime forensics alike. Initial drafting of policies and procedures may seem laborious, but without them haphazard investigations can ensue, resulting in compromised evidence and negative outcomes.

Both teams need a set of clearly communicated rules and policies in advance of an investigation. How will evidence be handled? What processes must be followed? What laws and regulations will dictate notification procedures? What is the policy for auditing procedures to make sure the process was followed correctly?

For cyberforensics, an incident response plan is a good step in documenting procedures. Each department within the organization should be included, with roles and responsibilities clearly defined, including assignments for specific action items with associated timelines. On an annual basis, the plan should undergo a comprehensive review, with modifications made where appropriate, and employees should be trained on how to effectively carry out the plan.

With so many similarities between physical crime scene investigations and cyberforensics, detectives and information security professionals can learn not only from each other’s best practices, but also from the tactics each follow to ensure their teams are avoiding common mistakes.

In the end, both groups have the same goal – build public trust and take measures to prevent a similar attack from happening in the future.