In an interview with CSO Online, Assistant U.S. Attorney Ed McAndrew shares tips on what organizations should do after a breach has been discovered. Instead of focusing on who’s responsible for the breach, organizations should focus more on data loss mitigation while providing law enforcement with details that may help solve who committed the crime. “The FBI and Secret Service are best equipped and positioned to conduct these national and international cyber investigations effectively and efficiently,” McAndrew said. He added the information that should be collected and given to law enforcement could involve any existing system logs, “SIEM data, IDS, DLP, endpoint data, network and data flow maps” that might provide insights.
Full Story