Messaging News - October 2008 - (Page 29)

be very inefficient. Companies choose areas that need monitoring, or a specific individual that is most likely committing some type of internal policy violation, and they monitor thusly.” Most of us have either been or currently are employees of a company that required us to sign documentation stating that inventions and all work belong to the company. Comments Fowler, “At least, this is the way North America does business. In knowing and embracing your status as a company employee, you understand that nothing on your desk—save for some pictures, weird objects, and a cup of coffee—belong to you. However, this is the very first thing that’s forgotten when arguments are presented. ‘How can your company spy on you?’ Well, they aren’t spying.” Fowler goes on to say that they are monitoring the data and workflow of their organization and asks: Shouldn’t any company in these scary economic times want to assure that it is operating at the most efficient and secure levels possible? “If you, as the loyal employee to Company X, are not in any violation of company policies, then the ad-hoc monitoring of your email and actions should not concern you—or should it? Depends on what you’re up to.” MB/TMP A Case in Point Peter Garza worked on both the Enron and Arthur Andersen cases and is an independent expert forensics investigator and former special agent with the Naval Criminal Investigative Service (NCIS). He has many stories to tell, but here is one about handling email forensics internally. A recent case that Garza worked on involved an IT manager that was adamant that there were only three servers he should be concerned with, “He was very insistent,” recalls Garza. “So I said, ‘That’s fine, let’s talk through what each of the servers does, educate me.’ We went through a technical interview on each system I learned several very important things—one, that there was a universe of about 28 different servers and of those 28 servers, about 13 were potentially relevant. Most importantly— even though the litigation Hold Letter had gone out (telling them not to delete anything)—we talked about one of the servers that they didn’t think was relevant. I found that as employees left, they would ghost their hard drives to the server, and keep the images on it. As the manager was describing what that server did, I asked, ‘So what happens to that data?’ The response was, ‘As it fills up and we run out of room, we delete the older data.’” The point of this story? Garza notes that some of the deleted data was central to the case. Mike Fowler, CISSP, EnCE, senior director of training, partner development for Guidance Software notes that computer forensics fills a large gap in IT capabilities and a greater need for comprehensive security. Single solutions and cutting edge tools can accomplish its goals at the hands of trained examiners employing investigative mindsets and utilizing proper methodologies but there is no quick fix forensic solution. Says Fowler, “There are brilliant tools on the market that are well worth a company’s time and energy to explore. The cost in dollars is dwarfed overall by the multiple uses for enterprise forensics and its total, almost immeasurable ROI.” MB/TMP FOR YOUR REFERENCE Contoural www.contoural.com Mr. Peter Garza http://forensic.org/ data/member_detail. asp?MembID=721 Guidance Software www.guidancesoftware.com LiveOffice www.liveoffice.com messagingnews.com 29 http://www.contoural.com http://forensic.org/data/member_detail.asp?MembID=721 http://www.guidancesoftware.com http://www.liveoffice.com http://www.messagingnews.com

Table of Contents Feed for the Digital Edition of Messaging News - October 2008

Messaging News - October 2008 Contents Editor’s Note Short Takes Targeting the Technology-Wise Customer The Insider Threat: The New Era of Disaster Recovery Making Collaboration Tools Pro-Knowledge Sharing Botnets Go Marching On Dissecting Email Forensics Next in Messaging News “On Message” with Ben Gross The World is Not the Center of the Universe, and Filters Don’t Stop Email Spam Making the Case Learn More

Messaging News - October 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.