Digital forensics
Technical analysis of an incident that establishes its entry point, timeline, scope and affected data, whose findings decide coverage, notifications and sometimes attribution.
Digital forensics covers the techniques used to reconstruct what happened in a security incident: collecting and preserving logs, disk and memory images, analyzing malware, rebuilding the intrusion timeline, identifying compromised accounts and the data viewed or exfiltrated. It follows evidence preservation rules, because its findings may be used in court. In a cyber claim it plays a role few other expert assessments reach. It determines whether the incident falls within the definition of cover, whether it began before the retroactive date, whether it exploits an unpatched vulnerability targeted by an exclusion. It sets the scope of mandatory notifications, since only people whose data was reached are notified. It feeds attribution, when the tools and methods found link the attack to a known group, possibly a state one. And it allows restoration without reinfection. Its cost, often several hundred thousand euros for a serious incident, is among the first covers of the policy.
The investigation carried out after NotPetya in June 2017 established that the code had been introduced through a trojanized update of M.E.Doc, a Ukrainian accounting software, whose update server had been compromised weeks earlier. That single entry point explained why the victims were companies doing business in Ukraine, and fed the attribution to a Russian intelligence service.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.