If a security incident is handled carelessly or the applicable specifications are disregarded, important evidence for investigating the incident or pursuing legal action may be unintentionally destroyed or rendered inappropriate for court proceedings.

Consider the following examples:

• An attacker infects a client with malware whose mode of operation and objective can only be analysed when the system is running. For this analysis, information on the active processes and the content of the main memory must be backed up and evaluated. If the client is shut down prematurely, the information can no longer be used to analyse and get to the bottom of the security incident.
• An administrator finds a running process on a server that is causing an extraordinary CPU load. In addition, this process is creating temporary files and sending unknown information over the Internet. If the process is terminated prematurely and the temporary files are simply deleted, it will not be possible to find out whether confidential information has been stolen.
• An important server becomes compromised because the administrator was not able to install the latest security updates as planned due to the heavy load on the server and the lack of a free maintenance window. To avoid any possible disciplinary consequences, the administrator installs the missing updates before a security team is able to analyse the source of the intrusion and the damage resulting from it. A workplace culture with a low tolerance for employee errors has therefore prevented analysis of the problem.

• BSI -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)