CISSP Training Guide

Introduction

The topics of this chapter all interrelate. Computer crime laws are based on rules of ethics. The prosecution of a computer crime depends on the availability of evidence. And, evidence is gathered through investigations.

Often, breaches of computer security are also crimes for which perpetrators can be prosecuted in court. Gathering evidence for prosecution therefore might be one of the objectives in a response to a computer security incident. Some types of evidence are better than others, and often the difference depends on the techniques used to gather and preserve the evidence. This chapter shows the relationships between security breaches, law, incident response, and computer evidence forensics. It also introduces the ethical ...