Digital Forensics and Incident Response

Jump kit

One facet to incident response that can present a challenge to CSIRT team members is the possibility that they may have to respond to incidents outside their own location. Off-site response is quite common in larger enterprises and is even the norm in CSIRTs that consult for other organizations. As a result, CSIRTs may often have to perform the entire response at another location without the support of a digital forensics laboratory. With this challenge in mind, CSIRTs should prepare several Jump Kits. These kits are preconfigured and contain the hardware and software necessary to perform the necessary tasks a CSIRT would be called on to perform during an incident. These kits should be able to sustain an incident investigation throughout ...