Digital Forensics and Incident Response

Running head: DIGITAL FORENSICS
Digital forensics and incident response
Name of the Student:
Name of the University:
Author Note:

DIGITAL FORENSICS1
Digital forensics and incident response
Digital forensics may be defined as the collection and evaluation of digital evidence that is
present in electronic systems and the following response to potential attacks and threats.
Digital forensics and incident response (DFIR) is the use of forensics for cybersecurity by
examining breaches and malware in the data (Luttgens, Pepe and Mandia 2014). DFIR is the
combination of two of the essential domains of cybersecurity, considering the increasing
number of testified violations over the past few years. Any organization needs to have the
ability to respond to cyber-attacks immediately. Tackling such incidents effectively requires
specialized training and expertise in technical domains, which include operations system
design, file systems, intelligence system and host attack vectors. A policy for incident
response has become vital with the growing trends of a data breach in organizations. The
team responsible for incident response in any organization has to monitor, handle incidents
and report suspected breaches or attacks (Nikkel 2014).
Personal learning experience
During the course on digital forensics, the field that particularly interested me was the part of
the incident response. This is because I realized that with the growing trends of breaches,
litigations and frauds in the corporate sector, incident response is an integral part of digital
forensics which each organization will need (Elyas et al. 2014). I assimilated that when an
incident is reported, it is essential to outline a workflow of the procedure consisting of the
guidelines to manage the issue. It helped me learn that the immediate response includes
classification of the incident into minor, standard or critical and prioritizing the incident as
low, medium or high. After successfully prioritizing the incident, the primary goal is to
minimize the count of affected endpoints to prevent the spread of the problem to other
devices and therefore contain the issue. Further, I learned that it involves collecting discrete