8/14/2019 EFF: EFF bootcamp hacked

http://slidepdf.com/reader/full/eff-eff-bootcamp-hacked 1/1

ELECTRONIC FRONTIER FOUNDATIONProtecting Rights and Defending Freedom on the Electronic Frontier

4 5 4 S H O T W E L L S T R E E T, S A N F R A N C I S C O , C A , U S A 4 1 5 . 4 3 6 . 9 3 3 3 W W W . E F F. O R G

EFF Civil Liberties Director Jennifer Granick 

Wa d W Y’v B AadP r e - A t tA c k P r e P A r At i o n : e s t A B l i s h A P r o t o c o l

• Developorganizationalpoliciesthatmakeclearwhoinsidethecompanyshouldbecontacted,whenlawenorcementwillbecontacted,iandwhenmonitoringwillbedone.

• Protocolshouldbepolicyandpracticeoninormationhandling,inormationintegrity,appropriateuseoorensictools,reportingtohigher-ups,legalcounsel,lawenorcement.

• NeedITproessionalstrainedintheidentication,collection,examination,andanalysisodatawhilepreservingtheintegrityotheinormationandmaintainingastrictchainocustodyorthedata.

• Also,needtogetmissioncriticalserversbackupandrunning.• Lasttwogoalscanbecontradictory.Someonewillneedtodecide.

l e g A l i s s u e s

• Liabilityorharmtocustomers

• Liabilityorharmtoothersystemsattackedthroughyours

• Databreachnoticationrequirements

• Preparingtondandprosecutetheattacker

• Lawsandregsdiferordiferentindustriesandromstatetostate

D i g i t A l F o r e n s i c sForensictechniquesareuseulorinvestigatingcrimesandinternalpolicyviolations,reconstructingcomputersecurityincidents,troubleshootingoperationalproblems,recoveringromaccidentalsystemdamage.

c:Neverdoorensicsontheoriginalmedia.Mustdeterminewhatisrelevantandmirrorthatdata,inamannerthatpreservestheintegrityothedata.

exama:orensicallyanalysedatawhilepreservingitsintegrity.

Aay:uselegallyjustiabletechniquestoderiveuseulinormationthataddressesthequestionsthatweretheimpetusorperormingthecollectionandexamination.

rp:Descriptionotheactionstaken,howtoolsandprocedureswereselected,whatotheractionsneedtobeperormed,andprovidingrecommendationsorimprovementtopolicies,procedures,tools,andother

aspectsotheorensicprocess.

i s s u e s

• Cost,ResponseTime,DataSensitivity

• Outsideproessionalsorin-house?Levelotraining?

• Regularbackups,maintainanceanddestruction

• Policiesonwhenandhowtoaudit

• Preservingintegrityoauditrecords

• Systemordeterminingwhetherprograms,datahavebeenaltered