Chapter 3: Types of Vendor and Computer Forensics Services

---

OVERVIEW

Cyber crime potentially costs U.S. businesses millions, if not billions of dollars in unrealized profits and exposes organizations to significant risk. And it is on the rise. In 2001, the Computer Emergency Response Team (CERT) reported a fivefold increase on the number of computer security incidents reported in 2000.

As information technology and the Internet become more integrated into today’s workplaces, organizations must consider the misuse of technology as a real threat and plan for its eventuality. When cyber crime strikes, the real issue is not the incident itself, but how the organization responds to the attack.

With that in mind, this chapter looks at how a swift and measured forensic incident response, drawing on sound policies, vendor tools, and support, allows an organization to contain the potential damage of an attack and effectively seek compensation or prosecution. In addition to the preceding, this chapter also covers the following computer forensic services:

• Forensic incident response

• Evidence collection

• Forensic analysis

• Expert witness

• Forensic litigation and insurance claims support

• Training

• Forensic process improvement

---