Chapter 21 — Digital forensics and malware analysis: service integration
Lesson map
Lesson 21 published. Map, example, EX061.
flowchart TD
N0["Learning outcomes"]
N1["21.1 IT service management"]
N2["21.2 Preservation step"]
N3["21.3 Service levels"]
N4["21.4 External providers"]
N5["21.5 Problem records"]
N6["21.6 Change records"]
N7["21.7 Reporting"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX061"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["21.1 IT service management"]
N2["21.2 Preservation step"]
N3["21.3 Service levels"]
N4["21.4 External providers"]
N5["21.5 Problem records"]
N6["21.6 Change records"]
N7["21.7 Reporting"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX061"]
[Learning outcomes]
|
v
[21.1 IT service management]
|
v
[21.2 Preservation step]
|
v
[21.3 Service levels]
|
v
[21.4 External providers]
|
v
[21.5 Problem records]
|
v
[21.6 Change records]
|
v
[21.7 Reporting]
|
v
[Worked example] --> [Exercise EX061]
Learning outcomes
You will (1) integrate forensic readiness into IT service management; (2) link incidents, problems and changes; (3) define service levels for preservation; (4) work with external providers.
21.1 IT service management
The city's service desk handles incidents, problems (root causes) and changes. Forensic needs fit into each: security incidents get a preservation step; problems track root causes such as shared admin passwords; changes implement controls.
For the CLERK-03 case, the incident record held the clerk's report and the preservation step; a problem record captured the shared local admin passwords as a root cause; change records carried each control into production. Linking the three lets anyone follow a control back to the incident that justified it.
21.2 Preservation step
The incident template now asks: Could this be a security incident? If yes, call the security analyst before remediation.
The question is deliberately simple so helpdesk staff can answer it under pressure. A yes or unsure answer pauses remediation and triggers a call, which is exactly what Jonah did when the antivirus scan was started on CLERK-03. The template records who answered, when and who was called, so the preservation step leaves evidence of its own. Staff are trained that unsure means yes.
21.3 Service levels
Preservation targets: security analyst contacted within 15 minutes during business hours; memory captured from affected key hosts within one hour.
In the CLERK-03 case, memory capture from mfoster's desktop took about two hours from first report. The new targets turn that experience into commitments. They are measured from ticket times, reported monthly and reviewed when missed, so a target that cannot be met leads to more resources or a revised target, not to silence. Out-of-hours targets are stated separately. Misses are recorded with a reason.
21.4 External providers
The hosted payments portal and cloud email are run by providers. Contracts should state log retention, access for investigations and response times. Jonah reviews contracts and finds the payments provider keeps access logs for 30 days only.
A 30-day retention means that if the payments portal were involved in an incident discovered a month later, its access records would be gone. Jonah raises the gap with the contract owner and asks for longer retention or a regular export, and records the provider's support contact and request procedure in the inventory.
21.5 Problem records
Root causes from the investigation become problem records with owners and due dates.
The shared local admin password problem, for example, is owned by the desktop team with a due date for rotating all 140 machines. Open problems are reviewed monthly, and closure requires evidence such as a configuration report showing unique passwords. This keeps root causes from being forgotten once the incident is closed. Problems without owners are escalated to the IT manager. A problem closed without evidence is reopened at the next review.
21.6 Change records
Each control change references the incident or problem it addresses, so auditors can trace why.
When an auditor asks why desktops can no longer connect to each other by remote desktop, the change record points to the incident and the finding behind it. The link also helps future administrators avoid removing a control whose purpose they do not know. Jonah adds a reference field to the change template so the link is never optional. Old changes without references are linked during reviews where possible.
21.7 Reporting
Monthly service reports include security incidents, preservation times and open problems.
The monthly report shows how many incidents had a preservation step, how quickly the analyst was contacted and how many problems remain open. Trends matter more than single months; a slowly rising contact time is an early warning that the on-call rota or the template is not working. The report goes to the IT manager and is summarised for the risk committee each quarter. Each figure names the ticket fields it was drawn from, so a reader can check the calculation.
Out-of-hours cover
Incidents do not respect office hours. The city arranges an on-call rota for the security analyst role with a backup, and the service desk's out-of-hours provider is given the preservation step and contact list. A test call each month confirms the numbers work and the on-call person answers within the target time.
Worked example
A clerk reports a strange pop-up two weeks after the incident. The service desk follows the new template, flags possible security incident, and calls Renata within 8 minutes. Triage shows a benign browser extension; the record closes with the preservation step documented anyway.
Synthetic case. The ticket is invented.
Errors and limits
Templates help only if staff use them; review a sample of tickets monthly.
Exercises
- EX061 — Template question. What question was added to the incident template? Rubric: 3 = could this be security incident; call analyst before remediation; 2 = partial; 1 = vague; 0 = none.
- EX062 — Provider gap. What contract gap was found? Rubric: 3 = payments provider keeps access logs 30 days; 2 = partial; 1 = vague; 0 = none.
- EX063 — Change traceability. Why reference incidents in change records? Rubric: 3 = auditors trace why controls exist; 2 = partial; 1 = style; 0 = none.
Synthesis
Embedding preservation in service management makes forensic readiness routine.
Continue studying — chapter 21 of 30
← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →