Running head: BCDR & IR COMPUTER FORENSICS… 1

BCDR & Incident Response Computer Forensics & Crisis Management

Lorenze Salas

Professor Michael Vasquez

BCDR & IR COMPUTER FORENSICS… 2

BCDR & Incident Response Computer Forensics & Crisis Management

Key Terms Information

Incident Response - An organization handles identifying data breaches or cyber-

attacks to minimize the damage and reduce the risk for future

attacks.

- It follows the six stages: preparation, identification,

containment, eradication, recovery, and follow-up.

- They are influence more by “information security, forensics,

and cybersecurity” (Paull. 2019).

- The IR procedures needs to be forced by the IR team and/or

crisis management side.

- Example: T-Mobile getting breached for the 3 rd time in

August 2018, November 2019, early March 2020.

Business Continuity - It deals with the business side; they continue to operate when

proceeding through and following a disaster.

- Their planning can take account to “smaller interruptions or

minor disasters, such as extended power outages” (“Business

Continuity vs. Disaster Recovery: 5 Key Differences”, 2020).

- Incident Response and Disaster Recovery are referred with

Business Continuity.

- Example: 2021 Colonial Pipeline cyberattack.

Disaster Recovery - They responded catastrophic events, for instance an active

shooter, cybercrime, terrorism, natural disaster, and much

BCDR & IR COMPUTER FORENSICS… 3

more.

- It is a key component for business to act of an event and

settle things down to normal as soon as possible.

- It creates “additional employee safety measures, such as

conducting fire drills or purchasing emergency supplies”

(“Business Continuity vs. Disaster Recovery: 5 Key

Differences”, 2020).

- Business Continuity and Disaster Recovery have different

goals when it comes preparation to a response.

- Example: 2021 Microsoft Exchange Server data breach.

Computer Forensics - In is an investigation technique to preserve evidence from a

computer device to be used in a court of law, they act liked

Incident Response.

- There are different types of computer forensics: Database,

Email, Malware, Memory, Mobile, and Network.

- Their first step is to gather the evidence (computer) and then

analysis the data to present their findings in a court.

- Investigating former Apple engineer, Xiaolang Zhang, for

downloading trade secrets and arrested by the FBI in 2018.

Crisis Management - They are “identifying a threat to an organization and its

stakeholders in order to respond effectively to the threat”

(Hayes, 2021).

- In a normal operation, it can have a negative impact when

BCDR & IR COMPUTER FORENSICS… 4

there is a problem such as data breaches, terrorism, lost of

sales, death of a person, and damage reputation.

- Example: The COVID-19 pandemic where the retail stores

were empty, and people were hoarding.

Other Information - How Incident Response, Business Continuity, Disaster

Recovery, Computer Forensics, and Crisis Management

integrate from each other? In most cases, their goal is

minimizing future attacks and protect the public from data

breaches, terrorism, disasters, and further on.

BCDR & IR COMPUTER FORENSICS… 5

References

Business continuity vs. disaster recovery: 5 key differences. (2020, September 28). UCF

Online. https://www.ucf.edu/online/leadership-management/news/business-continuity-

vs-disaster-recovery/

Colonial pipeline – A ransomware attack hits close to home. (2021, May 13). JD

Supra. https://www.jdsupra.com/legalnews/colonial-pipeline-a-ransomware-attack-

5412347/

HAYES, A. (2021, March 1). Crisis management definition.

Investopedia. https://www.investopedia.com/terms/c/crisis-management.asp

Lutkevich, B. (2013, May 2). What is computer forensics (cyber forensics)? - Definition from

WhatIs.com. SearchSecurity. https://searchsecurity.techtarget.com/definition/computer-

forensics

Osborne, C. (2021, April 19). Everything you need to know about the Microsoft exchange server

hack. ZDNet. https://www.zdnet.com/article/everything-you-need-to-know-about-

microsoft-exchange-server-hack/

Paull, A. (2019, February 29). Response operations. BCP, IRP, and DRP. The differences,

similarities, and why you need all three. Compass IT

Compliance. https://www.compassitc.com/blog/response-operations.-bcp-irp-and-drp.-

the-differences-similarities-and-why-you-need-all-three

What is Incident Response? (n.d.).

VMware. https://www.vmware.com/topics/glossary/content/incident-response