|
Top 10 computer forensics tips for HR professionals
Legislation and regulation
Make sure you have read and understood the Data Protection Act and European Convention on Human Rights (especially Article 8). These have an important bearing on the way in which incidents can be investigated. What you cannot be doing is accessing people's computers when they haven't got an expectation that it might happen, and how and why it might happen. If you let them know through a policy that something's liable to happen, they don't have an expectation of privacy, and it's much more difficult for them to complain - provided you've got a legitimate purpose.
Policy
It is vital to have a comprehensive company policy in place covering the (mis)use of computers. This should form part of the employee manual.
Definitions
Define precisely what you mean by terms such as 'acceptable' or 'misuse'. The more detail you provide, the less room there is for interpretation and legal argument if a case goes to court.
Induction
Make sure new joiners are taken through the computer usage policy, and sign a form acknowledging that they have read and understood the document. Should an incident occur, you will need to be able to show that an employee was fully aware of the policy and the consequences for breaching the policy.
Exit interview
It is good practice to take leavers through a 'check-out' list during an exit interview, making sure they have returned all company property including electronic files and documents (or at least deleted copies from their private PC or laptop).
Incident management
Make sure you understand your role and responsibilities as part of an incident management team. Incident handling needs to be highly co-ordinated and controlled to be effective - every minute counts.
Incident scenarios
Make sure you have an appropriate response pre-planned to different scenarios. It's vital that things are handled correctly from the start - a case of suspected fraud, for example, will need to be dealt with in a different way to finding pornographic material on a desktop PC.
Confidentiality
Make sure investigations are kept completely confidential until they are complete. The premature leak of information may lead to people jumping to the wrong conclusions, and could seriously impede the successful conclusion on the investigation.
Continuity
Make sure an audit trail is kept at all times. If a case goes to court, you will need to be able to back up your version of events.
Call in the experts
The earlier computer forensics experts can be brought in, the better. Computers are a 'crime scene' like any other, and only expert investigators should be allowed to gather evidence.
http://personneltoday.com/Articles/Article.aspx?liArticleID=23611
Richard Coubry - ICT Training Specialist
<< back
|
Anthem ICT Support Service Helpdesk
