Top Highlights
- Invest in digital forensics to trace incidents to their origin, identify attackers, and contain affected systems while operations continue.
- Forensics alone isn’t fast enough: agencies must improve their ability to keep pace as cyber incidents unfold.
- Bridge security and operations early with liaison relationships during planning; merging the teams into one unit may backfire.
- Make cyber exercises realistic and proactive, involving offensive and defensive teams and real-world adversary intelligence so personnel know how to respond—even when data or communications are compromised.
The Issue
Air Force cyber adviser Wanda Jones-Heath urged the government to invest in digital forensics so it can better investigate cyber incidents and keep pace with threats. Forensics can reveal how an attack began, who was responsible, and which systems remain at risk. However, investigators often examine incidents weeks or months later. Therefore, Jones-Heath said agencies need stronger ways to respond while attacks are unfolding.
At a forum reported by CyberScoop, Jones-Heath also called for more realistic cyber exercises and greater intelligence-sharing. Jeffrey Hunt of the Defense Department’s Cyber Crime Center said security teams should work with operations teams from the start, but warned against merging them into one unit. These recommendations address risks to government networks and the personnel who must defend and operate them.
Critical Concerns
The Air Force’s warning about investing in digital forensics applies to every business, not just government agencies. A cyberattack can disrupt operations, expose customer or employee data, and leave a company unsure how the intrusion began or what was taken. Without reliable forensic tools and expertise, leaders may miss hidden access, make poor recovery decisions, or fail to preserve evidence needed for regulators, insurers, or legal proceedings. Consequently, costs can extend well beyond restoring systems: lost revenue, penalties, lawsuits, and damaged trust may follow. Digital forensics helps a business establish what happened, contain the breach, and recover with fewer unanswered questions.
Possible Actions
Timely remediation preserves volatile evidence, limits attacker dwell time, and enables reliable attribution and recovery.
Priority Actions
- Fund forensic readiness: Provide stable funding for trained investigators, forensic laboratories, and analysis tools.
- Improve visibility: Centralize and retain endpoint, network, identity, and cloud logs; synchronize system clocks and protect records from alteration. (NIST CSF: Protect, Detect)
- Standardize evidence handling: Establish procedures for collection, preservation, chain of custody, and secure storage so evidence remains trustworthy and usable.
- Strengthen response playbooks: Define how teams isolate affected systems, capture evidence before rebuilding, and coordinate with legal, intelligence, and operational partners. (Respond)
- Build investigative capacity: Train cyber personnel in digital forensics and incident response, and conduct realistic exercises to expose gaps.
- Review and recover: After incidents, identify root causes, close exploited weaknesses, restore systems from verified sources, and update controls and playbooks. (Recover, Govern)
Advance Your Cyber Knowledge
Stay informed on the latest Threat Intelligence and Cyberattacks.
Understand foundational security frameworks via NIST CSF on Wikipedia.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
