Corporate Digital Incident Investigation

Abstract

Listen

Translate article

<p><strong>Purpose:</strong> Information and communication technology are fundamental part of most business entities. Unfortunately, use of these technologies needs to be secured, and in the case that stipulated and legal regulations are not observed, it is very important to not only recognize but also prove such actions/incidents on time. Therefore, the ability to investigate the events/incidents in organization using traces in the information systems may be key component for regulation enforcement.<br /><strong>Methodology/Approach:</strong> We propose a model for digital investigations within the organization, based on ISO standards and existing models for common digital investigations.<br /><strong>Findings:</strong> The result of our work is a model that can serve as a guide to draft procedures for digital investigations within the organization. Such a procedure should provide evidence of a quality comparable to forensic evidence.<br /><strong>Research Limitation/Implication:</strong> Our model provides an overview of the entire process and recommendations for its implementation; However, it does not provide a list of specific examination methods, because they vary depending on the case.<br /><strong>Originality/Value of paper:</strong> Most of the previously presented models for digital investigations were focused on the investigation of the police forensic laboratories. The originality of our model lies in its focus on investigations in the business organization.</p>