Re: Two questions

Can you point me to sources about the possibility of needing a PI or other license to do forensics and incident response? I'm the local responder for our site. It sounds like I may be ok for now, being part of the IT staff, but I'd like to know more. I'd especially like to know more before I go to corporate with questions.

Thanks,

Bert Knabe
Technician
Lubbock Avalanche-Journal
806-766-2158


On Feb 25, 2008, at 1:24 PM, Jon R. Kibler wrote:

Michael,

I am NOT a lawyer and do not know the law in your area. However, I do
know that U.S. DoJ is pushing hard to require anyone doing anything
forensics or incident response to be a licensed PI.

Please see my embedded comments...

Michael Condon wrote:
<SNIP>
I also need to find out if you just need certification, or just need to be a licensed PI, or both, in each of the three states.

My best advice would be to contact the a lawyer or the state attorney
general in each jurisdiction. You may also want to post a question to
Security Focus' forensics mailing list. However, be wary of any 'legal
opinions' you may receive.

However, I can tell you that in SC, to get a PI license requires 2 years
training and a year apprenticeship.

And what certification, if not CHFI, is recognized as sufficiently valid to perform this kind of investigation (perhaps CISSP/ISC2)?

I have heard law enforcement openly laugh at CHFI -- and CISSP and other
non-forensics certs are useless. The certification that I see most law
enforcement agencies require is the ISFCE/CCE -- which, as I understand
it, takes 3 years to obtain.

I've had to do internal sort of forensic work of this sort and more for former employers - it resulted in reprimand or at times termination.

These days, doing such work could easily get you criminally prosecuted.
I have been given legal advice to 'do nothing that can be construed as
forensics.' I was told that looking at someone's browser's history and
showing management where they had been going to xxxporn.com would be
considered doing forensics, as would using DNS query logging or sniffing
network traffic to show similar activity. It is even questionable as to
whether it is technically legal for an organization's IT staff, unless
they have a PI license, to use IDS logs to track down compromised systems,
as that may be considered incident response.

Insane mess? I agree.

Jon Kibler
--
Jon R. Kibler
Chief Technical Officer
Advanced Systems Engineering Technology, Inc.
Charleston, SC USA
o: 843-849-8214
m: 843-224-2494




==================================================
Filtered by: TRUSTEM.COM's Email Filtering Service
http://www.trustem.com/
No Spam. No Viruses. Just Good Clean Email.


Relevant Pages

  • Re: Two questions
    ... I am NOT a lawyer and do not know the law in your area. ... Security Focus' forensics mailing list. ... However, I can tell you that in SC, to get a PI license requires 2 years ... Filtered by: TRUSTEM.COM's Email Filtering Service ...
    (Security-Basics)
  • Re: Two questions
    ... I apologise asking before looking. ... I googled "PI license computer forensics" right after asking for more info, ... Filtered by: TRUSTEM.COM's Email Filtering Service ...
    (Security-Basics)
  • Re: Two questions
    ... And what certification, if not CHFI, is recognized as sufficiently valid to perform this kind of investigation? ... Are you a certified Forensics Examiner? ... doing ANY incident response or forensics ... Filtered by: TRUSTEM.COM's Email Filtering Service ...
    (Security-Basics)
  • Re: [Full-Disclosure] Things that make you go "Hmmm"
    ... That is the way proper forensics is carried out. ... > Information forensics is a very strange business, and incident response often takes you where you least expected to go at the outset. ... If the mail server was> configured to retrieve mail from spamsoap it is entirely possible that> the store and forward account was also compromised, leading to> potential disclosure without continued access to pivx network> infrastructure. ...
    (Full-Disclosure)
  • RE: Spam: RE: Forensic/Cyber Crime Investigator
    ... There is a confusion between forensic analysis and incident response. ... This is the role of forensics. ... But that's where you need ot know the law aspect. ... Investigations HIP Information Security Group ...
    (Security-Basics)