Challenges in Cyber Security Incident Investigations

This chapter discusses in brief a series of the unique challenges the cybercrime investigator may discover when compared to other crime types. Obtaining evidence across international boundaries is particularly difficult and expensive for civilian investigators. Whereas criminal investigators may benefit from using Mutual Legal Assistance Treaties to assist their investigations, civilian investigators have no such formal support. An investigator may be employed to provide a report to management to support a cyber‐insurance claim. With the dynamic nature of digital evidence, assessing the extent of the crime and its associated cost may prove difficult. Understanding these challenges is a skill learned by experience only. Lessons learned will be incorporated into the updated incident response plan, but also into the collective knowledge of the investigation team. With this information, investigation of subsequent cybercrime scenes will be undertaken.