An essential feature of an optimal post-incident recovery program is the ability to produce legally robust evidence of what has occurred. Without evidence, claims for insurance, against third parties and assistance to law enforcement become impossible. But without adequate planning for how evidence is to be identified, acquired and preserved, the results will be poor and management constantly faced with the dilemma that the collection of higher quality evidence may often mean powering down essential computing facilities, precisely what the rest of the incident recovery process is designed to avoid.
Peter Sommer will explain the legal and technical requirements for digital evidence, outline some typical scenarios and describe how proper management plans can be put in place.
About this presentation
- Speaker: Peter Sommer, London School of Economic (view biography)
Friday, July 1st — 09.45-10.15