ISSA-LA Security Summit XII

Digital forensics is the preservation and analysis of digital evidence that uses scientifically accepted and validated processes. There is a range of reasons digital forensics may be used, including a breach investigation to identify how a breach occurred and what data was exposed, an investigation of user behavior, recovery from ransomware and other cyberattacks and more. Evidence is always collected, examined, and managed in a forensically sound manner that can be used in a court of law, even if law enforcement or the court system is not involved.
 
We will be covering the basic steps of the process; scope, collection, examination, analysis, and reporting. After we get that basic understanding, we will examine some tools used, both open source and commercial. There is not a single-purpose tool that fits all cases and different tools are required for things such as network, computer, email, database, mobile devices, cloud services, and memory. We will highlight some of the most popular tools, explain the pros and cons of the tools and the different types of evidence being collected, and show some working examples. We will discuss real-world examples of Forensics and Incident Response use cases and examine the most recent Malware and Ransomware attacks. We will also discuss and review some of the most challenging cases including Insider Threat, Cyberespionage and "Living off the Land". Join us for this informative yet entertaining training class.