Incident Response: A Strategic Guide to Handling System and Network Security Breaches

Chapter 7. Legal Issues

Incident response, of all the computer security disciplines, is probably the most affected by legal considerations. Many, if not most, incidents involve some sort of crime. Those that do not almost certainly involve some sort of policy violation.An organization might want to prosecute an offender, in which case it must consider the legal implications of the incident and must assist law enforcement in preparing the case (or at least ensure that the incident response team’s actions do not impede the investigation and prosecution). An organization might choose not to prosecute but to instead take some kind of administrative ...