Forensic Investigation
Closely related to auditing is incident investigation and ad hoc queries. Audits are frequently conducted in conjunction with the occurrence (or anticipation) of specific incidents (e.g. breach of patient privacy, disgruntled employee accused of wrong doing). However, unanticipated or unusual incidents often occur.
Researching this type of incident generally requires the creation of ad hoc queries which put together search criteria specific to the incident at hand. Furthermore, the queries may flow together as the investigation extends from system to system, over multiple time frames or involves multiple users. The ability to create and forensically trace a transaction or series of activities across multiple systems, applications, users, or fields becomes invaluable.
FairWarning provides this capability, enabling the investigator to construct ad hoc queries which put together an unlimited number of search criteria.
Chain of Custody
FairWarning can also digitally sign and encrypt your log files creating a tamper proof environment. This is an important aspect of creating a security & privacy environment that is suitable in the event an incident goes to trial.
###
