The Chief Information Security Officer (CISO) of an e-retailer, which has an established security department, identifies a customer who has been using a fraudulent credit card.
The CISO calls the local authorities, and when they arrive on-site, the authorities ask a security engineer to create a point-in-time copy of the running database in their presence.
This is an example of:
Click on the arrows to vote for the correct answer
A. B. C. D.A.
The scenario described is an example of "creating a forensic image," which is answer A.
Forensic image is a bit-by-bit copy of the original data that is taken for the purpose of analysis, investigation, or legal proceedings. In this case, the security engineer was asked to create a point-in-time copy of the running database in the presence of the local authorities. This is likely to be used as evidence in the investigation of the fraudulent credit card use.
Creating a forensic image ensures that the original data is preserved and that any analysis or investigation can be conducted without changing or damaging the original data. This is important for legal purposes because any evidence obtained from a tampered or corrupted source is inadmissible in court.
Deploying fraud monitoring, answer B, refers to the practice of continuously monitoring transactions for signs of fraudulent activity. This is a proactive measure that aims to prevent fraud from occurring in the first place, rather than investigating it after the fact.
Following a chain of custody, answer C, refers to the process of maintaining a documented record of who has had access to evidence, when they had access to it, and what they did with it. This is important for maintaining the integrity of evidence and ensuring that it can be used in court.
Analyzing the order of volatility, answer D, is a process of identifying which sources of evidence are most volatile and should be analyzed first. This is done because some sources of evidence, such as system memory, are highly volatile and can change quickly, while others, such as hard drives, are less volatile and change more slowly. This process is used in forensic investigations to ensure that the most critical evidence is captured before it is lost.
In conclusion, the scenario described is an example of creating a forensic image, answer A, which is the process of taking a bit-by-bit copy of the original data for the purpose of investigation or legal proceedings.