Security

Ask something
Discussion Locked

What to do Legally.

0 helpful
5 replies

by gprinsloo 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Given that an Employee, External hacker etc. has made an attempt or entered your systems.

What would the minimum legal requirements be with regards the collection of the

1. Forensics - Store all evidence on read only media. (CD/Dvd, Magnetic tape)
2. Print and authenticate all printable evidence, seal and enter into evidence.
3. Maintain historic records of logons and attempts, audit trails etc. for how long ???

What else or how else should one be prepared to gather and maintain enough evidence to build, maintain and win a case.

5 replies

by gprinsloo

Calling the authorities only works if you have a solid case to prove.

I think at this point in time guilt in digital crime is more directed to the owner (Prevent it) rather than the perpetrator who commits it.

by txiso

You don't have to have an open-and-shut case in order to call them in, and they usually have much better forensics tools than you do. Just tell them what you suspect and let them collect the evidence. If you think you'll prosecute if you do have a case, then involve the authorities from the beginning. If you don't plan to prosecute no matter what, then you can be looser with the investigation.

by rlknapp1

The art and science of a forensic analysis is very tricky, especially if you are going to prosecute.

Hire an expert.

by andrew06

I agree, talk to someone who is an expert in this field and that is what they are paid to do as a job.

If you want to get a stronger case, speak to a Forensic Expert and an Lawyer that specialises in Communications and IT.

You would probably make a winning case then.

This discussion is closed to new replies.