5.8.2. Training, Testing, and Digital Forensics

💡 First Principle: An untested IR plan is a theoretical document, not a real capability. Training ensures people know their roles; testing ensures the plan actually works; digital forensics ensures evidence is preserved for investigation and legal proceedings.

Training: regular training for all IR team members on procedures, tools, and communication. Tabletop exercises walk through scenarios to test decision-making without technical execution.

Testing: simulation exercises test technical capabilities under realistic conditions. Red team/blue team exercises test both attack detection and response effectiveness.

Root cause analysis — identifying the fundamental cause that allowed the incident to occur (not just the immediate exploit). A root cause analysis might find that the real issue wasn't the phishing email that delivered malware — it was the lack of email filtering, the lack of user training, AND the excessive permissions that allowed the malware to access critical systems.

Threat hunting — proactively searching for threats that have evaded detection. Unlike monitoring (reactive, alert-driven), threat hunting is hypothesis-driven: "If an attacker compromised our VPN, what would we see?" Hunters look for indicators that automated tools missed.

Digital forensics — collecting, preserving, and analyzing digital evidence in a legally defensible manner:

• Legal hold — preserving data that may be relevant to legal proceedings. No deletion or modification permitted.
• Chain of custody — documenting every person who handled the evidence, ensuring it hasn't been tampered with. Required for evidence to be admissible in court.
• Acquisition — creating forensic copies (bit-for-bit images) of digital evidence. Original evidence is preserved; analysis is performed on copies.
• Integrity — verifying evidence hasn't been altered using cryptographic hashes. Hash of the original must match hash of the copy.
• Preservation — storing evidence securely with controlled access and environmental protection.
• E-discovery — the process of finding and producing electronically stored information for legal proceedings.
• Order of volatility — collect the most perishable evidence first, because it is lost on power-off or overwritten quickly. Per RFC 3227, from most to least volatile: CPU registers and cache; routing/ARP tables, process table and RAM; temporary file systems; disk; remote logging and monitoring data; physical configuration and network topology; archival media and backups.

⚠️ Exam Trap: Chain of custody is critical for legal admissibility. If evidence changes hands without documentation, it may be deemed inadmissible. The correct order is: identify → preserve → collect → analyze → report. Always preserve before collecting — turning on a powered-off system can alter volatile data.