>> Hello Cybrarians.
Welcome back to incident response
>> in advanced forensics.
>> My name is Max Alexander,
and I'll be your subject matter expert for
the legal aspects of incident response.
One of the first things we want to look at in
the legal aspects are
legal considerations when it
>> comes to incident response.
>> First and foremost, every type of action that you
perform during your incident response must be legal.
Any type of illegal action that
you're taking as you're going about
your incident response process could render any type of
evidence that you collect
inadmissible for future legal proceedings.
Going back to that first bullet point
of incident response must be legal.
Your organization may span different jurisdictions,
it may span globally.
As an incident responder,
you have to be aware of all the applicable laws,
rules, and procedures that
are applied to your organization.
That could be numerous laws and rules.
a s incident responders,
you have to be aware of those,
and you may not have to know every single one of them
because that's what your legal counsel's there for,
but you do have to be cognizant of some of
these basic rules and then know when
to actually seek out that legal counsel.
For instance, if you have something that
happens to your organization where
someone has stolen some type of data
or perpetrated some crime against your organization,
you may want to take that person to court,
either criminally or civilly.
If you do take certain actions that are illegal,
any evidence that you gather might
actually be thrown out of
court which could damage your case.
Worse, any type of
illegal action that you take might actually pose
a greater threat to
your organization than the initial incident itself.
If you go back to one of
our first discussions where we talked about
the damages posed by incidence to an organization,
one of the slides that I had
talked about or showed an iceberg,
and the tip of the iceberg had all
of the known damages and the
below the surface damages or
most of the cost of incident response had.
If you're conducting your incident response
in an illegal manner,
some of those hidden costs might be media relations,
if your incident response goes bad or illegal and it
gets out that your organization
>> wasn't following the law.
>> Also the individual whom
you're trying to build a case against,
if you violate that person's rights,
he may in fact bring legal action
against you and further damage your organization.
Another aspect in legal consideration
we want to talk about are hackbacks.
A hackback is essentially where
an organization is going to destroy
an information system or hack into
an information system that they believe hacked them.
Now, it doesn't happen often,
but it does happen.
There haven't been any prosecutions
that I'm aware of this occurring,
but nevertheless, it is illegal,
and it does set your organization up for some type of
legal ramification if and when
the federal prosecutors do want to pursue this.
Also on top of this,
if you're doing hackbacks,
you may not necessarily be harming
the actual attacker who's
taken information from your organization.
Often times in hackbacks or in these hacks,
individuals who perpetrate these crimes
are using someone else's server who is more than
likely unaware that their server
is being used for some type of malicious activity.
If your organization starts
destroying Mom and Pops server
who are trying to run
their small business in some small town,
and that gets out to the news media, well,
obviously that would be
>> pretty bad for your organization
>> and it might actually be
worse than the initial hack itself.
One of the first things we want to talk about
when securing evidence and
doing searches as it relates
to our incident response is the 4th Amendment.
The 4th Amendment is essentially the bedrock
of privacy when it comes to the US Constitution.
The 4th Amendment provides that the right of
the people to be secure in
>> their persons, houses, papers,
>> and effects against unreasonable searches and
seizures shall not be
violated and no warrants shall issue,
but upon probable cause
>> supported by oath or affirmation,
>> and particularly describing the place to be
searched and the persons or things to be seized.
A very short statement that actually contains a lot of
information that highlighted some very important points
when it comes to the 4th Amendment,
is that first of all,
the 4th Amendment protects
individuals from searches that are unreasonable.
There's lots of case law out there that
describes what is and what is not reasonable.
The 4th Amendment protects
individuals against unreasonable searches.
If you want to know what is and what is not reasonable,
it's best to consult
your legal counsel and they should have
a good idea and understanding of
the reasonableness of a particular search.
The next aspect that I've
>> highlighted is probable cause.
>> Essentially what probable cause is,
is the belief by
a reasonable and intelligent person
that a crime has been committed,
which would allow someone to be arrested,
or the person searched,
or a civil case to be brought against them.
Again, that goes to a reasonable person standard.
Then the last thing is particularly describing
the place to be searched and
the person or things to be seized.
If you do get a search warrant,
you can't just bill in and blatantly take everything in
the house or search
everything that you feel like searching,
if it does not actually
describe that within that warrant.
The warrant is going to
limit the scope of that government search,
and then you're going to have to
stay within the confines of that search.
Now a lot of this applies
to the government and or agents of the government.
In your organization, it may not specifically apply to
a corporation [NOISE] or a
>> non-governmental organization.
>> That being said, if you do have
a crime committed against your organization,
and you do hope to essentially bring that person to
prosecution and you're consulting
with law enforcement, at some point,
you may actually become an agent
of the government even if
the law enforcement agency is not actually
investigating the case but they're
providing some type of direction.
It's important to understand how
the 4th Amendment affects individual's rights.
The ultimate goal of
the 4th Amendment is to protect people's right
to privacy and freedom against
these arbitrary governmental intrusions.
Then private intrusions not acting in
the color of government
are exempt from the 4th Amendment.
Again, it's a very slippery slope
once you start involving
law enforcement and once you start going
about doing some of these activities,
it's very important that you
understand when the 4th Amendment comes into play.
I would highly suggest that if you
do come into some of these gray areas
that you consult with your legal counsel.