Show Notes
Cyber attacks on business and government organizations are exceedingly common these days. Not all cyber attacks are or result in a data breach. More often than not, the objective is to encrypt the victim's IT network and demand that a ransom be paid in order to have the data decrypted.
The top five things to do when you detect a cyber attack:
Leave devices running and keep systems functioning and online. You've already been compromised so you might as well provide an opportunity to the forensics responders to collect the available evidence before contaminating the scene. Without evidence, there is little that we can determine in the aftermath of a cyber attack. It is very important to understand precisely what occurred and how in order to prevent it from happening again.
Contact the privacy and data breach lawyer that is part of your incident response plan. Your organization may be facing liability for exposing client data during a cyber attack so it's best to have a qualified and experienced lawyer involved from the start.
Have your lawyer (see #2!) engage a digital forensics team to collect evidence and respond to the attack. A qualified incident response team will contain and eradicate the threat or malicious attacker. Further, and perhaps most importantly, when engaged by your lawyer, all work, evidence and findings by your digital forensics team are protected under solicitor client privilege. This prevents it from being used against your organization down the road if there is a lawsuit or class action claim.
Report the matter to your cyber insurance provider, if coverage is in place. Hopefully, you have coverage for the potential enormous losses that can flow from a cyber attack. It is always recommended that you put your insurer on notice of a potential claim early.
Conduct a full and thorough investigation following a cyber attack. Learn what happened in order to avoid having it happen again. Changes may be required to your IT network. Your personnel may need to be made more aware of risks related to cyber crime and your incident response plan may require updating following an attack. This is only possible if you know what happened.
For more information on Cyber Security and Incident Response Plans, contact DFI Forensics Inc. If you need a contact for cyber insurance or an incident response lawyer, we can provide one in any North American area.
More from The Digital Forensics Files Podcast
In growing numbers, victims are having intimate images posted online without their consent. Once without appropriate recourse, a new BC law seeks to provide much needed help to victims.
Civil or criminal, all cases require a focused and open mind ready to find the important details that tell the true story. Digital forensics examiners use specialized skills, training and tools to locate and analyze key artifacts that reveal the truth. In this episode of The Digital Forensics Files Podcast, Tyler Hatch of DFI Forensics discusses his overall and recent experiences assisting criminal defense lawyers. Listen in to gain insights into the world of digital forensics and how it can help in criminal cases. Don't miss out on this informative episode!
Cole Popkin, of Popkin Consultations, is an enthusiastic digital forensics analyst who graduated from Davenport University with a Bachelor's Degree in Digital Forensics. He has worked with the Michigan State Police and the US Department of Homeland Security.
Receiving a negative Google review is frustrating, but an opportunity to learn and do better - assuming it's real. When it's a fake negative review, the stakes are raised as the poster is motivated by an attempt to harm your reputation and injure your business. But, fortunately, there are ways to effectively deal with a fake negative Google review and we go through in this episode!
Pandemic woes! A group of employees join a video call early when all of the sudden they hear the vivid sounds of pornography. The employees point the finger at the soon to be fired employee from whom the sounds appear to be emanating from. HR gets involved, interviews everyone and issues a termination letter. The fired employee hires a lawyer and DFI Forensics gets the call for an examination of the employee's computer and cell phone.