Question

During an incident, we are concerned about response times and containing the incident. Therefore, it is best to just shut off and disconnect computers from the corporate network so we can conduct a forensic investigation. Argue for or against this position citing research when needed to support your position

Answer 1

Answer)

In the incident, we are concerned about the response time and we need to contain the incident as soon as possible. However, it is not always best to just shut off and disconnect computers from the corporate network so we can conduct a forensic investigation.

First, we should analyze whether or not a forensic investigation or investigation of any type is actually needed. If not needed, and the issue can be solved then the computers should not be shut off and disconnected.

Secondly, in need of a forensic investigation, we need to be concerned about the response times of the program in the incident and also to contain the incident. There should be no more data leaks, the business should be no more impacted, and thus we need to contain the situation. However, the shut off and disconnect computers from the corporate network should be the last step when everything and every other containment method fails.

Thus, it is not best to just shut off and disconnect computers from the corporate network, as this hampers performance and the absence of sufficient capacity of the business to handle such issues. Disconnection and shutting off is not the solution and thus the situation is not solved, it is just hampering the business.