Rethinking digital forensics in incident response

The term DFIR has become really popular over the last several years and is used as an all-encompassing term for digital forensics and incident response. But the reality is that there is actually an inherent contradiction between digital forensics and incident response, because the actual end goals of digital forensics and incident response are actually not the same. The reality is that for most organizations, incident response focuses on making the pain go away, and maybe improving security going forward.

Thinking about a legal outcome is far from the reality for most organizations. So, while incident response may involve the use of techniques and methods used in digital forensics, the incident response is not always done with a legal end in mind. However, the growing regulatory environment in countries around the world is changing the landscape when it comes to incident response. Now, more than ever, responding to an incident cannot simply be about making the pain go away. Digital forensics is needed now more than ever before.

Digital forensics is not only necessary for identifying the perpetrators to hold them accountable, but now it is also needed to defend an organization that has suffered from a cybersecurity incident against regulatory or legal action that could be brought against it as a result of the incident. This talk will explore the typical different focus between digital forensics and incident response and how these two fields have diverged in practice over the years, but also how the changing regulatory and legal environment around the world should bring them back together into closer alignment.