GL&BC Company
GL&BC Company should particularly invest in training its cybersecurity team in the basics of digital forensics. This will, in turn, reduce the need to hire another separate digital forensics team which will increase costs. Training is necessary because it will provide a practical understanding of the techniques, tools, procedures and policies that are vital for digital forensic investigations. The training course will essentially cover the different steps of digital forensics, that is, collection, handling, presentation and reporting of digital evidence. Additional training aspects that will be included are the retrieval of deleted or hidden files, network forensic, reverse engineering, and proper adherence to the USA evidence law. For any evidence that will be acquired, it must be relevant, authentic, reliable and complete before it is presented in a court of law.
Since training in itself can be expensive, the organization should make use of E-learning platforms, video conferencing, and chat forums. These methods will ensure that the cybersecurity team of IT professionals don’t have to travel to physical are of training. More so, the virtual methods will offer flexibility such that each individual will allocate time to go through the training notes. However, the firm should set strict deadlines for particular readings and assessment to ensure employees remain on their toes. Physical meetings should be limited to the crucial practical sessions.
Standards and best practices
The International Organization for Standardization (ISO) in conjunction with the International Electrotechnical Commission (IEC) set global standards for the handling of digital evidence. The two bodies provided guidelines in four phases of digital forensics, identification, collection, acquisition and preservation, and GL&BC must, therefore, incorporate these practices in the establishment of digital forensics.
In identification, the relevance of any evidence is based on its value and volatility. The collection phase involves gathering digital devices that could contain digital evidence being sought. In this, static acquisition or live acquisition is conducted depending on the situation and in each, data acquisition priorities should be considered in terms of data accessibility and volatility. The guidelines spelt out in acquisition insist that integrity of evidence should be maintained and only authorized individuals should have access to it. Lastly, evidence should be preserved throughout the case.
Tools and models
Digital forensics team should have a wide variety of tools that it can use in different situations. Some of these tools include commercial software such as CAINE, open-source tools like Wireshark or other forensic programs (Fruhlinger, 2019). These tools are further categorized depending on the task to be undertaken and these categories include email analysis tools, network forensic tools, disk and data capture and database forensic tools, among others. The firm should have tools for each category since a security breach can occur at any point.
Mitigation of challenges
Digital forensics has challenges that can be grouped into three parts, that is, technical challenges, legal and resource (Chirath, 2017). Technical challenges occur due to advancement in technology where cybercriminals can evade security features and remain undetected. Constantly updating forensic tools and techniques will help to overcome the technical drawbacks. Legal challenges occur when digital forensic experts probe or share private information to acquire evidence. The organization should ensure it is conversant with privacy laws within the USA. Lastly, resource challenges involve large volumes of data that need to be analyzed. To mitigate this challenge, work can be divided among the team members.