Investigation data sources

Logs

May require special permission for access

May be best sources

Some will be very sensitive

Consider privacy as well

People

Interviews are becoming more common

• Client-side attacks via phising still top the list of breach causes

Be conscious of employee time and commitments

Consider the fidelity of information gathered during interviews

Can't be treated the same as raw data

Drive images, memory dumps

Memory if often the best for live breaches

Don't forget sensitivity of memory and drive images

Maintain access logs and chain of custody

Don't interfere with IR response process!

Cloud service provider

More frequently becoming a valued partner/data source in IR

Might have unique access to some information

Often key in helping establish root cause

Will sometimes offer IR services