Malware Detection: Forensics

Malware Detection Student’s Name Institution Malware Detection 1. What is the role of forensics in incident response and when should forensic investigators be involved in the situation? Forensics is an important part of a computer incident response team in an organization. It allows an organization to determine the exact extent of the breach by determining what data was downloaded, saved and/or printed. Also, forensic professionals suggest to the organization on how to prevent such future incidences. This is because in the course of the investigation they will examine the equipment and determine how the breach occurred. The insight will also is also useful in creating the lessons-learned report which is the last step in the incident handling process that comes up with recommendations to prevent such incidences in the future (Maras, 2015). The following are some of the situations in which forensic investigators are involved: when corporate information is disclosed, either by accident or design, without permission. When an employee steals intellectual property from their employer and uses it to set up a rival company or passes it to a competitor. Industrial espionage, white-collar crimes and when an employee violates a computer policy. Also, damage analysis and assessment after an incident have occurred. 2. Malware must first be detected before it can be removed. How can malware detection best be handled in a large corporate setting? Unlike in a small setting or single computers where simply cleaning up or rebuilding the affected host is sufficient in treating malware infections, combating malware in a large corporate setting involves more than locating suspicious programs on servers and work stations but also detecting and interfering with the use of malware on the network. In a corporate setting where many computers are loosely connected requires a holistic security incident cycle consisting of planning, resisting, detecting and responding (Bowen et al., 2018). Planning involves understanding the threat relevant to the computing environment to determine the most likely infectious vendors to the organization, considering the actions to ...