Forensic and Incident Response: Cybersecurity Report Analysis

This report delves into Forensic and Incident Response (FIR) within the context of cybersecurity. It highlights the application of digital forensics in investigating data breaches, malware, and cyber-attacks. The report emphasizes the importance of incident response as a critical process for organizations to address illegal or intolerable activities on their computer systems. It discusses the evolution of FIR techniques, the need for proactive threat hunting, and the critical evaluation of digital forensics in identifying and mitigating cyber threats. The report also examines the considerations for building an effective FIR team, including the choice between in-house and third-party services. The references provide insights into the integration of agile principles in incident response, forensic readiness for SCADA/ICS systems, and novel digital forensic techniques in cloud environments.

Running head FORENSIC AND INCIDENT RESPONSE
FORENSIC AND INCIDENT RESPONSE
Name of the Student:
Name of the University:
Author’s Note:

1FORENSIC AND INCIDENT RESPONSE
Description:-
FIR is the forensics application for cyber safety use cases to inspect data breaks,
malware, and more. Nowadays, digital forensics practices have prepared their technique to the
commercial world for cyber safety, corporate inquiries, and e-Discovery (Grispos, Glisson and
Storer 2014). Just as centralized and government administrations search for apply digital
evidence to convict criminals, IT executives, safety, and authorized teams can use digital
forensics to accumulate and preserve proof to examine and protect against a cyber-attack, break
an insider risk, or finish an internal exploration.
Incident response is a processor safety term, and forensics is an authorized term (Eden et
al. 2016). IR is any administration's response to any illegal, illegitimate, or intolerable activity
that happens on one of the business computer structures. The forensics is the detection of
evidence from process media to upkeep a permitted proceeding.
Critical Evaluation:-
Digital forensics is the technique of covering the examination and retrieval of things that
originate in digital tools to recognize and improve any illegal or hacking movement. FIR is the
most vital fields of information safety, given that there have been a surprising amount of
affirmed damages in the previous some years.
Any business currently must have the ability to rapidly and professionally reply to cyber-
attacks. Conversely, looking at past documents, it turns out that most businesses do not have an
experienced IT workforce who can professionally switch security breaks. Operational tackling of
such happenings wants special preparation in numerous extremely technical fields counting file

2FORENSIC AND INCIDENT RESPONSE
systems, operating system strategies, host outbreak vectors, and intelligence of probable
networks.
Any organization's IR team is the most reliable companions in the market to switch its
complicated safety issues (Eden et al. 2015). The organizations' let their shareholder agreement
for these techniques even before they want it. Any organization then locked at a reasonable rate
and arranged for any security break. In the present situation, there is a vital necessity for every
business to have a strategy set for IR.
The IR strategies and procedures have changed quickly over the previous several years.
The organization cannot afford to apply obsolete FIR techniques that be unsuccessful to
categorize compromised methods correctly (Kebande and Venter 2018). The key is to discover
for outbreaks that get past safety systems continuously, and to catch interruptions in
development, rather than after attackers have finished their purposes and done poorer destruction
to the business. For the IR, this procedure termed as "threat hunting."
Conclusion:-
There are more than a few categories of inquiries that an organization must consider
when constructing an FIR team. When examining an in-house occurrence, the chain of
safekeeping is not that serious. A business could handover those expenditures and the danger of
taking an on-site FIR team by contracting these categories of facilities with a team of experts. In
Internal FIR team can be constructed to match what a business needs or wants. Maybe the
noncriminal or public inquiries would be controlled by the internal team and the rest by a third-
party organization. Perhaps the business needs to have a team proficient in dealing with every

3FORENSIC AND INCIDENT RESPONSE
kind of investigation as an alternative, which needs legal guidance, a bigger team, and a lab to
fulfill values for compliance.
References:-
Eden, P., Blyth, A., Burnap, P., Cherdantseva, Y., Jones, K. and Soulsby, H., 2015, September.
A forensic taxonomy of SCADA systems and approach to incident response. In 3rd
International Symposium for ICS & SCADA Cyber Security Research 2015 (ICS-CSR 2015) 3
(pp. 42-51).
Eden, P., Blyth, A., Burnap, P., Cherdantseva, Y., Jones, K., Soulsby, H. and Stoddart, K., 2016,
August. Forensic readiness for SCADA/ICS incident response. In 4th International Symposium
for ICS & SCADA Cyber Security Research 2016 4 (pp. 142-150).
Grispos, G., Glisson, W.B. and Storer, T., 2014. Rethinking security incident response: The
integration of agile principles. arXiv preprint arXiv:1408.2431.
Kebande, V.R. and Venter, H.S., 2018. Novel digital forensic readiness technique in the cloud
environment. Australian Journal of Forensic Sciences, 50(5), pp.552-591.