Firms not responding effectively to data breaches

A computer forensics expert has blasted as ineffective the way that most corporates deal with security breaches including network intrusion, data theft or destruction.

Most firms dispatch internal IT staff to investigate and tell senior management the scope of the damage, according to Greg Fordham, founder of computer forensics firm K&F Consulting. He claims that this approach is analogous to returning to your home, finding a window broken and the place ransacked and deciding to call the repairman before the police.

Fordham believes that systems personnel can do more damage than good as they are usually not well suited for incident response since they are not trained to collect and preserve digital evidence and will likely change important date and time stamps, lose volatile memory, and change or overwrite free space.

"Even if the consequence of these blunders can be neutralised, they still bring complexity and cost to any subsequent litigation that may be initiated. And their actions could also raise doubt about the authenticity of significant evidence," Fordham said.

Fordham also said the lack of forensic analysis training and experience could result in telltale signs of wrongdoing going unnoticed.

"The average IT staff member may not be aware of the additional data resident in many computer system artifacts or even how to interpret them. Without the knowledge of their existence or how they could be used, false conclusions could be reached," he said.