Thanks to visit codestin.com
Credit goes to www.scribd.com

Scribd
Upload
904 views2 pages

Forensic Readiness Checklist

The document is a digital forensics readiness checklist that provides questions for organizations to assess their preparedness. It covers areas like policy and procedures, legal and regulatory compliance, public relations, incident response, asset inventory, auditing and logging, infrastructure, training, and logistics. The checklist contains over 100 questions across these categories and provides a maturity scale of 0 to 5 to evaluate an organization's capabilities in each area.

Uploaded by

damtek
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
904 views2 pages

Forensic Readiness Checklist

The document is a digital forensics readiness checklist that provides questions for organizations to assess their preparedness. It covers areas like policy and procedures, legal and regulatory compliance, public relations, incident response, asset inventory, auditing and logging, infrastructure, training, and logistics. The checklist contains over 100 questions across these categories and provides a maturity scale of 0 to 5 to evaluate an organization's capabilities in each area.

Uploaded by

damtek
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

Digital Forensics Readiness Checklist

WareOnEarth Communications, Inc.


(703) 517.1327 E-mail: [email protected]
www.wareonearth.com/resources_forensics.html

DigitalForensicsReadinessChecklist
Rateyourselfagainstthesefundamentalreadinesssteps.Howpreparedareyou?
Policy&ProcedureReview
[]2 Doesyouracceptableusepolicysetexpectationsforausersexpectationofprivacy?
[]2 Haveyouestablishedastanceregardingpursuingcriminalprosecutionagainstoffenders?
[]3 Areallchangestocriticalsystemsformallydocumented?
[]3 Arewarningbannersusedonallcriticalsystemsindicatingunauthorizedusecanbemonitored?
[]3 Hastheprocedureforhandlingevidenceandconductinganinvestigationbeenclearlydefinedand
implemented?
[]3 Haveyouclearlydefinedwhatapprovalsareneededbeforeinvestigatorscanstartgatheringevidenceabout
anemployee?
[]3 Haveyouestablishedanescalationpathandapprovalsthatincludesoffhourssupport?
[]3 Haveproceduresbeenestablishedtogatherevidenceforapotentialfutureinvestigationwheneveran
employeeisdismissed?
[]3 Isitstandardproceduretoforensicallywipeallmediausedinaninvestigationbeforeitisreused?
[]3 Hasapolicybeendefinedforhowlonginvestigativedatawillberetained?
Legal&Regulatory
[]1 Areyourlegalstafffamiliarwithdatabreachlawsandapplicableregulationsrelatedtoinformationsecurity?
[]3 Hasthelegaldepartmentbeenformallyincludedintheinvestigationescalationpath?
[]3 Haveyouaccountedforrequirementstoreportpotentialdatabreachestoregulatorsinyourincident
handlingprocedures?
[]3 Hasitbeendocumentedwhoneedstobenotifiedintheeventofadatabreach,includinggoverningbodies,
partners,customers,andemployees?
[]3 HavelocalrequirementsforinvestigatorstoobtainPrivateInvestigatorlicensinginsomestatesbeen
researchedandaddressed?
PublicRelations&Messaging
[]2 Haveyoudefinedwhoneedstorevieworapprovepublicstatementsormessagestocustomers?
[]3 Doyouhaveaplantogetinformationtocustomersinanemergency?
IncidentTracking&RiskDecisions
[]2 Haveyouestablishedcriteriaforclosinganincident?
[]4 Aremetricscapturedfortrackingthenumberofeventsvs.incidents?
[]4 Arethereguidelinestodeterminewhenamalwareinfectionisworthinvestigatingversusfixing?
[]4 Haveyouimplementedanincidenttrackingsystemtoreportonthenumber,type,anddurationofsecurity
incidents?
GeographicRequirements
[]2 Isyourstafftrainedinremoteofficestogatherevidenceandsenditbackforanalysis?
[]3 Haveyouresearchedanddocumentedtheapplicableinternationallawsthatmayconstrainaninvestigation?
EnterpriseDocumentationReview
[]3 HaveyoudocumentedwhatIPspaceyouuseinternallyandexternally?
[]3 HaveyoudocumentedwhatIPspaceyourcustomersandpartnersuse?
[]3 IsaDHCPhistorystoredonthenetworkandmaintainedaccordingtotheretentionpolicy?
[]3 WhereNATisbeingusedinthenetwork,areaddresstranslationlogsavailablemaintainedaccordingtothe
retentionpolicy?

WareOnEarth Communications, Inc. 1 of 2


Digital Forensics Readiness Checklist
WareOnEarth Communications, Inc.
(703) 517.1327 E-mail: [email protected]
www.wareonearth.com/resources_forensics.html

AssetInventory&Profiling
[]2 Haveyoutestedyourforensictoolswithanynonstandardhardwaresuchastablets?Whataboutanon
standardOSlikeIRIX?
[]3 Doyouhavestandardbuildsorimagesforstagingsystems?
[]3 Doyouhaveaninventoryoryourassetsandsoftware?
[]4 Doyouhavehashdatabasesofknowngoodsoftwareusedinyourcompany?
[]4 Doyouhavecryptographichashesofsystemimagesorcoresystemfiles?
[]4 Haveyourassetsbeenratedintermsofcriticalityorrisksensitivitytotheorganization?
[]4 Haveyouestablishedsystemandnetworkbaselinesofnormalconfigurationsandactivity?
InformationGatheringPoints
[]1 Isanetworksnifferinplaceoravailableforcentralaggregationpoints?
[]2 Havepossiblenetworkspanportsbeenidentified?
[]2 Haveyoutestedyourforensictoolswithyourdiskencryptionsoftware?
[]2 AreyoumonitoringalloutboundtraffictotheInternet?
[]3 Haveyouestablishednetworkmonitoringpointsthatcanviewunencryptedtraffic?
Auditing&LoggingReview
[]2 Haveyouverifiedthathistoricalemailmessagesandmailboxescanberetrieved/searchedondemand?
[]3 Haveyouverifiedthatsecurityrelatedeventsarebeingcapturedonallcriticalsystems?
[]3 Haveyouconfiguredallcriticalsystemstosynchronizetheirtimewithatrustedsource?
[]3 Haveyouimplementedacentralloggingsystemforallcriticalsystems?
[]3 Doespolicyrequirelogentriestobekeptforaminimumofthreemonths?
[]3 Arelogentrieswrittentoprotectedmediaandcryptographicallyhashed?
Infrastructure&Tools
[]1 DoyouhavemobileUSBstoragedevicesbigenoughtostorelargeserverimages(700G1T)?
[]2 Doesyourmobiletoolkitincludeknowngoodbinariesandtoolsforalloperatingsystemsused?
[]3 Haveyouestablished,properlysegmented,andtestedavirtualenvironmentforanalyzingpotential
malware?
[]4 Isthereasecurestorageareaforevidencewithproperaccesscontrolsandauditing?
Training&Education
[]3 Hasyourtechnicalsupportstaff,suchashelpdeskpersonnel,beentrainedtoidentifyanincidentandreport
it?
[]4 Isyourinvestigativestaffcertifiedbyanindustryacceptedbodyindigitalforensicwork?
[]4 Doyouhaveatrainingplantohelpyourstaffstaycurrentontechnologiesandtechniquesbetween
investigations?
OtherLogistics
[]1 Canyourconferencebridgesupportmorethan20parties?
[]3 HaveyouestablishedanemergencycontactlistforthirdpartyproviderssuchasISPs,andmanagedservice
providers?
[]3 Havecontactsbeenestablishedwithlocalandfederallawenforcementinadvance?
[]4 Doyouhaveathirdpartyinvestigationserviceonretainerincaseaninvestigationrequiresseveralweeksof
work,advancedskills,orextendedworkoutsideyourhomegeography?
Usethematurityscaletodetermineifyouhavemettheallrequirementsforthatlevel(level4shouldbe
thegoalformostorganizations):
0Nonexistent|1Initial/adhoc|2Repeatablebutintuitive|3Definedprocess|4Managedandmeasurable|5Optimized

WareOnEarth Communications, Inc. 2 of 2

You might also like