Management will be cautious of the cost for implementing a digital forensic readiness program. While cost implications will be higher where organizations have immature information security programs and strategies, the cost is lessened for organizations that already have a good handle on their information security posture. In either case, the issues raised by the need for a digital forensic readiness program have to be presented to senior management where a decision can be made.
Cost analysis of a digital forensic readiness program has to be weighed against the value-added benefits that the organization will realize once implemented. To make an educated and informed decision about whether implementing a digital forensic readiness program is practical, organizations must be able to perform an “apples-to-apples” comparison of the tangible and intangible contributors to the program. The starting point of this task is to document the individual security controls that will be aligned to the digital forensic readiness program through a service catalog.
Appendix D: Service Catalog further discusses the service catalog to better understand how to hierarchically align individual security controls into the forensic readiness program.
Cost Assessment
Forensic readiness consists of costs involving administrative, technical, and physical information security controls implemented throughout the organization. Through the service catalog, each of these controls will be aligned to a service where all cost elements can be identified and allocated appropriately. While not all controls and services will contribute to digital forensic readiness, the following will have direct influences to the overall cost of the digital forensic readiness program:
• Governance document maintenance is the ongoing review and updating to the information security and evidence management frameworks (eg, policies, standards, guidance, procedures);
• Education and awareness training provides continued improvements to:
• information security awareness of staff indirectly involved with the information security discipline;
• information security training of staff directly involved with the information security discipline;
• digital forensic training of staff directly involved with the digital forensic discipline.
• Incident management involves the activities of identifying, analyzing, and mitigating risks to reduce the likelihood of reoccurrence;
• Data security includes the enhanced capability to systematically gather potential evidence and securely preserve it;
• Legal counsel provides advice and assurance that methodologies, operating procedures, tools, and equipment used during an investigation will not impede legal proceedings.
The inclusion of a service as a cost contributors to the digital forensic readiness program is subject to the interpretation and appetite of each organization. Knowing which services, where controls are aligned, contribute to the digital forensic readiness program is the starting point for performing the cost assessment. From the service catalog, the breakdown of fixed and variable costs can be used as part of the cost-benefit analysis for demonstrating to manage the value of implementing the program.
Benefits
With digital forensic readiness, it is necessary to assume that an incident will occur, even if a thorough assessment has determined that residual risk from defensive information security controls is minor. Depending on the impact from this residual risk, organizations need to implement additional layers of controls to proactively collect evidence to determine the root cause.
When organizations come to the realization that some type of investigative capability is required, the next step is to address this need through efficient and competent capabilities. Digital forensic readiness that is designed to address the residual risk
and enhance proactive investigative capabilities offers organization with the following benefits:
• Minimizing costs: Operating on the anticipation that an event or incident will occur, organization will minimize the disruption to business functions and support investigative capabilities that are much more efficient, quick, and cost effective. Having precollected digital evidence, the investigative workflow becomes much simpler to navigate through as more focus can be placed on the processing and presentation phases.
• Control expansion: In response mode, the capabilities and effectiveness of information security controls provide functionality limited to notification, containment, and remediation. Where proactive monitoring is utilized, organizations are able to expand their implementation of these information security controls to identify and mitigate a much wider range of cyberthreats before they become more serious incidents or events.
• Crime deterrent: Proactive evidence gathering, combined with continuous monitoring, of this information increases the opportunity to quickly detect malicious activity. As word of proactive evidence collection become more widely known, individuals will be less likely to commit malicious activities because the probability of being caught is much greater.
• Governance and Compliance: With a good information management framework in place, organizations can better demonstrate their ability to conduct incident prevention and response. Showing this maturity not only provides customers with a sense of security and protection when it comes to safeguarding their assets, but investors will also have more confidence in the organizations ability to minimize threats against their investments.
• Law enforcement: Ensuring compliance with laws and regulations encourages good working relationships with both law enforcement and regulators. When an incident or event occurs, the job of investigators is much easier because the organization has taken steps to gathering digital evidence before, during, and after an incident or event.
• Legal preparations: International laws relating to electronic discovery (e-discovery), such as the Federal Rules of Civil Procedure in the United States, Rules of Civil Procedure in Canada, or the Practice Direction 31B in the United Kingdom, require that digital evidence is provided quickly and in a forensically sound manner. Information management in support of Electronic Discovery (e-discovery) involves activities such as incident response, data retention, disaster recovery, and business continuity policies; all of which are enhanced through a digital forensic readiness program. When an organizations enters into legal proceedings, the need for e-discovery is significantly reduced because digital evidence will already be preserved, increasing the probability of success when used as part of legal defense.
•
Disclosure costs: Regulatory authorities and law enforcement agencies may require immediate release or disclosure of electronically stored information
(ESI)
2 at any time. An organization’s failure to produce the requested ESI in an appropriate and timely manner can result in considerable financial penalties for being noncompliant with mandated information management regulations. A digital forensic readiness program also helps to strengthen information management strategies, including data retention, disaster recovery, and business continuity, by having digital evidence proactively gathered in a forensically sound manner makes it possible for organizations to easily process and present ESI when required.
In June 2005, AMD launched a lawsuit against its rival Intel, claiming that Intel engaged in unfair competition by offering rebates to PC manufacturers who agreed to eliminate or limit the purchase of AMD microprocessors.
As part of e-discovery, AMD requested the production of e-mail evidence from Intel to demonstrate this claim. Intel failed to produce the e-mail evidence due to (1) a fault in e-mail retention policy and (2) failing to properly inform employees that their ESI was required as evidence through legal hold.
Due to this failure to produce evidence, in November 2009, Intel agreed to pay AMD $1.25 billion as part of a deal to settle all outstanding legal disputes between the two companies.
Appendix E: Cost-Benefit Analysis further discusses how to perform a cost-benefit analysis to determine if implementing a forensic readiness program is valuable to an organization.