Steve Jackson
Digital Forensics is a vital part of a mature cybersecurity stack but the field of digital forensics is more than 40 years old, and so are the methods. As a consequence of this, chances are you are using digital forensics in a purely reactive, investigative manner to report on a breach after the event and create learnings for the next time.
Forensics is capable of providing so much more value to the overall cybersecurity and incident response processes in large enterprises.
Fortunately, there is a new breed of digital forensics solution emerging which is changing the nature of forensics and unleashing a whole new set of valuable use cases and outcomes. This new category is called Modern DFIR.
Here are some of the ways modern DFIR is disrupting and innovating to deliver faster containment and remediation of breaches and enhanced levels of resiliency.
Lightning Fast
Is there a more critical component in the cybersecurity response than time? When a breach occurs every second counts and costs! Legacy forensic tools take many hours to acquire, and many more to parse, the necessary evidence needed to effectively investigate an attack.
Modern DFIR solutions are different, completing evidence acquisition and preparation in just a few minutes. This makes it possible to utilise full forensic-level visibility during a live incident response process for the first time.
Speed is also becoming an essential requirement for regulatory compliance in all major markets. Legislation that mandates a maximum reporting time of breaches is creating additional pressure on the incident response timelines and Modern DFIR is helping to alleviate this and ensure compliance is maintained.
Remote & Scalable
Modern DFIR solutions solve the problem of using legacy desktop and hardware forensics tools, that often require a 1:1 analyst to asset usage model, by centralising the investigation process on a browser-based console in a secure on-premise or private cloud environment.
Additionally, thanks to their web-native architecture, modern forensic solutions are completely scalable without adding additional time to the investigation. Investigating 1, 100, or 10000 assets concurrently from a central console with no degradation in performance delivers significant efficiency gains to the SOC team.
Integrated & Automated
In a modern cybersecurity environment, the ability to integrate different components of the security stack together and automate much of the process is becoming a core requirement. This helps to streamline and speed up processes while also reducing the pressure on the human resources, allowing them to focus on the high-value actions.
DFIR solutions meet this requirement by integrating with systems such as SIEM, SOAR, EDR, Syslog, etc., and allowing the automatic triggering of secondary forensic actions in response to their alerts.
These new forensic solutions also incorporate scheduling, playbooks, and auto actions to further automate digital forensics tasks.
Collaborative
Incident response and investigation is a team sport! With legacy forensic solutions it has been very challenging to share information at the case level and collaborate with colleagues.
Managing this process in a browser-based modern solution, which is consolidating a broad set of tools into a single platform, is allowing for real-time collaboration and delivering all of the time and efficiency gains that come with that.
AI-Assisted
Digital forensics is powerful. Having access to full forensic visibility on an asset offers an unparalleled opportunity to understand the what, when, where, how, and who of an attack. However, this level of visibility creates a lot of data that must be analysed and requires very specialist skills and experience to be done at speed.
Modern DFIR tools address this issue by using AI to deliver assisted compromise assessment on forensic evidence acquisitions. This type of technology helps to guide the analyst to important IoCs buried in the forensic data quickly and with confidence. This is also helping to reduce the reliance on high-level analysts in a time of skills shortage in the cybersecurity industry.
Proactive
Finally, by changing the nature of digital forensics, DFIR is opening up new proactive use cases that enable enterprises to leverage forensics at scale before an attack is initiated.
It is widely accepted that blocking and monitoring security solutions can never be 100% effective and breaches will occur. Proactive forensics is leading the way in assisting security teams to find and identify the “Unknown unknowns” residing on their network through techniques such as baseline comparison and diffing.
