Knowledge Retention & Sharing in DF/IR
DFIR veteran reflects on knowledge retention and sharing gaps across the industry, from EnCase training to PCI forensics workflows.
A personal essay recounts decades in digital forensics and incident response, arguing the industry rarely moves beyond individual or tribal knowledge to operationalize lessons learned. Examples include building condition files and custom EnScripts for PCI investigations at IBM ISS X-Force, and the lack of shared investigative processes in early-career environments.
- Early DFIR training focused on tool operation, not investigative reasoning
- Custom EnScript replaced flawed isValidCreditCard() to handle JCB and Discover cards
- Condition files and reporting templates operationalized PCI forensic processes
- Author argues knowledge sharing has improved little in 15 years
- Organizations
- IBM ISS X-ForcePCI CouncilISS
From the original article
4 min read at windowsir.blogspot.comI had an opportunity a bit ago to engage with three other folks within the industry, all at the same time, and all of us from varied backgrounds. We had some similarities in our backgrounds, and some overlaps or near-misses in our experiences and employment, but we were all very different folks in the same industry. In a lot of ways, this is what made this a very powerful meeting and discussion.
Lobsters · securityBy windowsir.blogspot.com via 7tehdt3cnw6kir6o · windowsir.blogspot.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.