◇ OpenCyber Academy
Postgraduate · Chapter 7 · English

Chapter 7 — Digital forensics and malware analysis: organizational integration

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Digital forensics and malware analysis: organizational integration

Lesson map

Lesson 07 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Where forensics sits"]
  N2["7.2 Interfaces"]
  N3["7.3 Playbooks"]
  N4["7.4 Readiness policy"]
  N5["7.5 Legal and risk"]
  N6["7.6 Exercises"]
  N7["7.7 Metrics"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Where forensics sits"]
  N2["7.2 Interfaces"]
  N3["7.3 Playbooks"]
  N4["7.4 Readiness policy"]
  N5["7.5 Legal and risk"]
  N6["7.6 Exercises"]
  N7["7.7 Metrics"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]

[Learning outcomes]
    |
    v
[7.1 Where forensics sits]
    |
    v
[7.2 Interfaces]
    |
    v
[7.3 Playbooks]
    |
    v
[7.4 Readiness policy]
    |
    v
[7.5 Legal and risk]
    |
    v
[7.6 Exercises]
    |
    v
[7.7 Metrics]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) integrate forensic capability into enterprise incident response; (2) define interfaces with SOC, IT, legal and risk; (3) embed forensic readiness in policy; (4) measure integration.

7.1 Where forensics sits

At Corvane, the SOC detects, incident response coordinates, IT recovers, and Marta's unit preserves and examines evidence. Before CF-21 these roles overlapped informally, causing delays: IT rebuilt two servers before forensic snapshots. The rebuild of two servers before snapshots was not malice or carelessness; IT followed its own recovery runbook, which said nothing about forensics. The cost was permanent: questions those servers could have answered stayed partly open in the final report. Marta treats the episode as a process failure to fix, not a team to blame.

7.2 Interfaces

A RACI matrix clarifies who is responsible, accountable, consulted and informed for each step: isolation, memory capture, snapshot, rebuild approval, regulator notification. For CF-21 the matrix would have shown, for example, that IT is responsible for rebuild approval but must consult Marta's unit for significant hosts. Regulator notification sits with legal counsel as accountable, with forensics consulted for facts. Writing these down removes the guesswork that led to the 08:30 rebuilds. The matrix is reviewed after each exercise and incident, so it follows how Corvane actually works.

7.3 Playbooks

Incident playbooks now include a forensic gate: no rebuild of a significant host without forensic sign-off, with a maximum wait time agreed with IT so recovery is not blocked indefinitely. The maximum wait matters as much as the gate itself. Without a limit, IT would see forensics as an open-ended block and look for ways around it. With a limit, IT can plan recovery, and forensics knows it must act within the window or record why it could not. For CF-21 that limit became 90 minutes, with an on-call forensic contact named in the playbook.

7.4 Readiness policy

ISO/IEC 27043 includes readiness processes. Corvane's policy now specifies log sources, retention, central forwarding, time synchronisation, and pre-approved collection tooling on endpoints. Each item in the policy traces back to a CF-21 gap. Central forwarding answers the rotated workstation logs, time synchronisation supports merging logs from many sources, and pre-approved tooling means memory capture does not wait for a software request. Retention settings for VPN and identity logs protect the evidence that showed the entry point. Compliance with the policy is checked through the log coverage metric.

7.5 Legal and risk

Legal counsel is engaged early to manage privilege and regulator contact; risk teams receive evidence-based impact assessments. In CF-21, counsel's early involvement shaped how the investigation's findings were recorded and when the regulator was contacted. The risk team needed to know how many customer accounts might be affected, and the forensic answer of 4,200 accounts on the share, with transfer of specific files unconfirmed, gave them a bounded figure. Counsel and the risk team are also invited to the twice-yearly exercises, so the interfaces are practised before the next incident.

7.6 Exercises

Joint tabletop and technical exercises twice a year test the interfaces. The exercises use synthetic incidents that touch the same interfaces as CF-21: an alert that should trigger snapshots, a rebuild request that must pass the forensic gate and a briefing for counsel. Problems found in exercises go to named owners with dates for a fix and a retest. A gate that is never exercised is likely to be skipped in the next real incident. Results of each exercise are reported against the integration metrics.

7.7 Metrics

Time from detection to forensic preservation; percentage of significant hosts preserved before rebuild; log coverage against policy. These three metrics come straight from the gaps found in the CF-21 review. Detection-to-preservation time was the baseline for the applied project, with a 3.5-hour median. The percentage of significant hosts preserved before rebuild captures the two lost servers, and log coverage measures whether the readiness policy is actually in place on endpoints. Each metric is reported quarterly, so drift shows up before an incident tests it.

Budget and staffing

Integration needs resources: an on-call rota, storage for snapshots and images, and endpoint collection licences. Marta presents costs against the CF-21 delays they would have avoided, giving the board a concrete comparison.

Worked example

In the post-incident review, the timeline shows two servers rebuilt at 08:30, before snapshots were taken, because IT did not know the forensic gate existed. Marta's action: add the gate to IT's change process, with a 90-minute maximum wait and an on-call forensic contact.

Synthetic case. The review is invented.

Errors and limits

Process changes need practice; a gate written in a playbook but never exercised may still be skipped under pressure.

Exercises

Synthesis

Forensics works best embedded in incident processes with clear interfaces, gates, readiness policy and metrics.

Continue studying — chapter 07 of 12

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →