Part 4 - Keys of Preservation | Cybrary

NEED TO TRAIN YOUR TEAM? LEARN MORE

Did you know Cybrary's video training is FREE? Join more than 2,500,000 IT and cyber security professionals, students, career changers, and more, growing their careers on Cybrary.

Time

9 minutes

Difficulty

Intermediate

Video Activity

This lesson covers the keys to preservation. In order to keep evidence clean and accurate, it is important investigators not tamper or alter any evidence. In addition, it is important to remember that evidence goes ...

NEED TO TRAIN YOUR TEAM? LEARN MORE

Did you know Cybrary's video training is FREE? Join more than 2,500,000 IT and cyber security professionals, students, career changers, and more, growing their careers on Cybrary.

This lesson covers the keys to preservation. In order to keep evidence clean and accurate, it is important investigators not tamper or alter any evidence. In addition, it is important to remember that evidence goes beyond computers and could also include devices such as IDS, routers, firewalls, sniffers or other devices. Finally, evidence must be collected in the order of volatility, which basically means the order that evidence that will change once power is shut off. Volatile evidence provides the strongest information about an incident.

Part 1 - An Overall View of the Course

Part 2 - The Humans Behind Cyber Security Incidents

Part 3 - The Sony Hack Case Study

Part 1 - An Overview of Incident Response Policy

Part 2 - The Elements of an Incident Response Policy

Part 3 - The Role of Communication with Law Enforcement when it comes to security

Part 4 - The Different Types of Incident Response Teams

Part 5 - Outsourcing Considerations

Part 6 - The Role of the Incident Response Manager

Part 7 - What does an Incident Response team do?

Part 1 - An Introduction to Incident Handling

Part 2 - CIRC Team Composition

Part 3 - Incident Response Policies

Part 4 - The REACT Principle

Part 5 - Maintaining the Integrity of the Scene following an incident

Part 6 - The Content of Notice

Part 7 - The Respond Part of Incident Response

Part 1 - An Introduction to legal considerations of incident response

Part 2 - Expectation of Privacy

Part 3 - Personally Identifiable Information (PII)

Part 4 - Giving notice to individuals

Part 5 -Benefits of Information Sharing

Part 1 - Forensics in Support of an Incident Response

Part 2 - The Phases of Investigation

Part 3 - The Preservation Phase of Investigation

Part 4 - Keys of Preservation

Part 5 - Volatile Data Considerations

Part 6 - Capturing the data

Part 7 - Imaging concepts

Part 8 - Volatile Memory Capture

Part 9 - Forensics in Support of Incident Response

Part 10 - Formatting a disk for Incident Response

Part 11 - Using the FTK Imaging Software

Part 12 - The Forensic Acquisition of Data from a PC

Part 13 - Navigating the H Drive

Part 14 - Obtaining the Windows Bitlocker Encryption Keys

Part 15 - Obtaining the Windows Bitlocker Encryption Keys (continued)

Part 16 - The Autopsy Program

Part 1 - What is Insider Threat?

Part 2 - American Superconductor Case Study

Part 3 - Indicators to identify an insider threat

Part 4 - Using Automated processes to look for indicators of in insider threats

Part 5 - Policy Enforcement

Part 6 - Policies and procedures

Part 7 - Policies and procedures (continued)

Part 8 - Policies and procedures (continued)

Part 1 - Malware incidents

Part 2 - Setting up a Virtual Machine

Part 3 - Dynamic Analysis

Part 1- Incident Recovery

Part 2 - Resiliency: The Answer to the Cyber Security Paradox

Introduction to SIEM

Responding to Cyber Security Incidents

Mastering Cyber Attribution

Incident Response & Advanced Forensics