The digitization of records and processes across government increases the need for sound digital investigation tools and processes. Whether it is looking into a data breach or gathering information for litigation, organizations are spending a lot of time culling through this data to get answers to pressing issues. An IDG survey found that a vast majority of organizations conduct digital investigations on a weekly basis. These investigations range from proving regulatory compliance, security incident response (including post-event analysis), and stopping high risk employee behavior (acceptable use violations).[Tweet "A look at digital investigations with Tod Ewasko, Director of Product Mgmt. at AccessData. #GovEventsBlog"]
We sat down with Tod Ewasko, Director of Product Management at AccessData to learn more about the role of digital investigations as a part of everyday IT efforts.
Q: Who "owns" forensics? IT? Legal? HR?
A: The answer is kind of all three. Many people lump forensics in with cybersecurity, but it's really a separate entity. Yes, forensics tools are used to investigate cyber incidents, but they are not preventative. That is what you have the "hunting" tools out there for - watching firewalls and logs for anomalous behavior or activity. Once that is stopped, then the forensics tools come in to make sense of it - to see how it happened and drive the plans to make sure it does not happen again. Forensic tools look beyond the event and gather all data relevant to the systems in question.
Q: Is forensics all reactive then? Continue reading




Blockchain is a new way to structure data for greater sharing and security. Its algorithm and distributed data structure were initially designed to manage online currency (like bitcoin) in a way that does not need a central administrator to distribute it among people. This removed the need for a middleman (like a bank) to authenticate that what was being transferred was real currency. Instead, this authentication happens because all of the nodes on a peer-to-peer network connected to the block (the asset, money, or data) have to "approve" its transfer to a new party (a good image of this process is
We've written before about the importance of 
