Doh! Why Don't We Have That: Tailoring Evidence Preservation for Incident Objectives

SANS DFIR Summit 2022

Speaker: Shelly Giesbrecht

What’s your worse case incident response scenario? And if that horrible thing happens, what would your organization need to help understand the how, what, when and maybe who? There are a lot of recommendations out there for what logs should be kept and for how long, what evidence to preserve, and what objectives you should have for an investigation. The problem with all of that is, it may not jibe with what you …

doh don incident objectives preservation