DER.2.2 Provisions for IT Forensics

If data is acquired and evaluated for forensic examinations, all the legal and regulatory framework conditions MUST be identified and met (see ORP.5 Compliance Management). Internal regulations and agreements with employees MUST NOT be violated. To that end, the supervisory/personnel board and the Data Protection Officer MUST be involved.

A guide MUST be drawn up for the IT systems used that describes the initial measures that must be carried out in the event of an IT security incident in order to destroy as little evidence as possible. This guide MUST also describe the actions that could destroy potential evidence and how they can be avoided.

If an organisation does not have its own forensics team, suitable providers of forensic services MUST be identified during the preparatory phase. The eligible providers of forensic services MUST be documented.

The areas in which forensic IT examinations and crisis / business continuity management overlap SHOULD be defined and documented. The employees responsible for specific tasks and the channels to be used to communicate with them SHOULD be specified. Furthermore, it SHOULD be ensured that the responsible contact persons are always available.

A guide describing how evidence is to be secured SHOULD be drawn up. This guide SHOULD specify procedures, technical tools, legal framework conditions, and documentation requirements.

All the employees responsible SHOULD know how to secure evidence and use forensic tools correctly. In this regard, suitable training SHOULD be carried out.

It SHOULD be ensured that tools for securing and analysing evidence forensically are suitable for these purposes. Before using a tool for forensics, it SHOULD be checked that it works properly. It SHOULD also be verified and documented that it has not been manipulated.

A forensic examination SHOULD always start by defining the goals or assignment in question. The goals SHOULD be formulated as precisely as possible. All the required data sources SHOULD then be identified. The order in which data is to be secured and a detailed process for doing so SHOULD also be specified. The order SHOULD be based on the volatility of the data to be secured. Highly volatile data SHOULD be secured promptly. Non-volatile data such as read-only memory SHOULD only be secured afterwards, followed by backups.

The method and time period for storing secondary data (e.g. log data or traffic transcripts) within the scope of the legal framework conditions for forensic measures to secure evidence SHOULD be specified.

Storage media SHOULD be forensically duplicated as completely as possible. If this is not possible (e.g. in the case of volatile data in RAM or SAN partitions), a method that changes as little data as possible SHOULD be selected.

The original storage media SHOULD sealed and retained. Cryptographic checksums that are documented in writing SHOULD be created from the storage media. These SHOULD be kept separately and in multiple copies. In addition, it SHOULD be ensured that the checksums documented in this way cannot be changed. A witness SHOULD confirm the corresponding procedure and certify the checksums so that the data is admissible in court.

Only trained personnel (see DER.2.2.A6 Training Personnel on Forensic Securing of Evidence) or a provider of forensic services (see DER.2.2.A3 Pre-Selection of Forensic Service Providers) SHOULD be assigned to secure evidence.

When evidence is secured forensically, all the steps carried out SHOULD be documented. The documentation SHOULD provide seamless proof of how secured original evidence has been handled. In addition, the employed methods and the reasons why the persons in charge used them SHOULD be documented.

All secured original storage media SHOULD be stored physically in such a way that only investigating employees known by name can access them. If original storage media and evidence are stored, the period for which they are to be retained SHOULD be specified. After this period expires, it SHOULD be checked whether the storage media and evidence must be stored further. After the end of the storage period, evidence SHOULD be securely deleted or destroyed, and original storage media SHOULD be returned.

An organisation SHOULD conclude call-off agreements or framework contracts with forensic service providers in order to have possible IT security incidents forensically investigated more quickly.

Standard procedures that make it possible to forensically secure volatile and non-volatile data as completely as possible SHOULD be created for applications, IT systems, and IT system groups with increased protection needs, as well as for distributed system configurations.

The relevant system-specific standard procedures SHOULD be implemented by proven (and preferably automated) processes. Furthermore, they SHOULD be supported by checklists and auxiliary technical resources—for example, by software, software tools on mobile storage media, and forensic IT hardware such as write-blockers.

All the employees involved in forensic analyses SHOULD take part in regular drills that provide training on how to secure evidence should an IT security incident occur.