PNNL

Abstract

A typical incident response pits technicians against networks that aren't prepared forensically. [1, 2] If practitioners do consider collecting network forensic data, they face a choice between expending extraordinary effort (time and money) collecting forensically sound data, or simply restoring the network as quickly as possible. In this context, the concept of organizational network forensic readiness has emerged. The following is a discussion of selected computer crime cases, using publically available information, spanning a period of time of several years, that together demonstrate the need for a preventive and proactive response to malicious intrusion over a reactive one. It concludes with recommendations for how to "operationalize" organizational network forensic readiness.