Perspectives

COVID-19 impact on forensic technology investigations

Insights for Risk, Legal and Security investigation teams

As organisations adapt to new ways of working in daily operations, their ability to respond to incidents and conduct investigations are impacted. As a result of this, the role of a forensic technology expert will need to change.

The future of work is rapidly becoming the present. The COVID-19 pandemic has accelerated the recent mass-shift to home working, and it looks to be here to stay. With this comes a number of challenges for organisations, in particular with technology, risk and legal operations.

At Deloitte we see changes that will affect data security, customer confidentiality and the detection of employee misconduct. In helping our clients to respond, we have set out below some of the ways in which this will impact them and their requirements.

  1. There will be a delayed increase in data thefts by employees

    Working away from the office increases the methods by which data theft can be carried out, including new methods to avoid preventative controls or oversight. We believe that individuals may initially hesitate to do this given the economic uncertainty, and are wary of carrying out risky acts which could lead to them being disciplined or dismissed.

    However, as industry reopens and economic progress starts to return, this could create a situation where more opportunistic data thefts might prevail, be it someone stealing intellectual property in order to get ahead in setting up their own company, joining a competitor, or perhaps a disgruntled employee seeking to cause harm to their employer.
  2. Confidentiality breaches will increase, and they will become harder to prove

    Working outside of an office-based environment allows individuals, authorised or not, to note down confidential and inside information with ease because it is more accessible. Household members could overhear confidential conversations or quite simply employees could write down or capture information using personal devices without being physically seen.

    Some of these actions are not recorded due to the mode by which the information is being stolen. Therefore, there is an increased need to focus on preventative and proactive investigation solutions to deter and prevent employees from carrying out malicious actions or accidentally exposing confidential information.
  3. Data thefts will increasingly utilise uncommon methods as individuals become more familiar with their home network set-ups

    Some methods of data theft may increase as systems being accessed outside of a corporate environment have lesser controls or restrictions. They may also become more sophisticated as criminal gangs learn how to exploit the new situation.

    Corporate IT systems may allow those working from home to connect to third-party systems with insufficient oversight. In particular, data transmittal to an unauthorised location, say, to a home NAS (Network Attached Storage) drive, may become harder to detect or prevent and this will likely lead to a requirement for more thorough and comprehensive analysis in finding evidence of any data theft.
  4. Acting as an expert will become more logistically complex

    In the past, a forensic technology expert might visit one or two office locations and perform a forensic data collection of any evidential assets that require analysis. In the COVID-19 world, employees are dispersed in different locations. As such, a ten-person data collection in one location could become a ten-location single-person data collection, all of which needs to be carried out at the same time to avoid unlawful or accidental data destruction.

    Throw in the local public health guidelines and rules, for example social distancing or travel restrictions, and this makes the situation even more challenging. Some forensic technology teams may not be large enough to handle this and themselves might have staff members unable to travel.
  5. There will be an increased need for forensic technology experts to have cross-disciplinary skills

    The proliferation in remote working technology will drive a demand in skills in analysing those types of technologies to a forensic level. Together with the continued growth in cloud technologies and the use of mobile devices, it will require forensic technology teams to cover the full gamut of disciplines: operating systems, computers, servers, mobile devices, video calling software, collaboration tools (Teams, Slack, etc.), security appliance logs, network traffic and more.

    No one expert can cover them all but your expert of choice needs to have the expertise within their teams when it comes to technology and forensic analysis in order to handle your investigative needs efficiently and effectively.
Take action now

For any organisation, a data theft or any type of digital forensic investigation can be difficult at the best of times. The first step is to revisit the threats to your organisation and ensure you have the skills and access to expertise needed to better protect your organisation, data and clients. Taking action now will help you to be better prepared to react quicker, prevent further reputational or brand damage and respond to any legal or regulatory action with the right expertise and advice.

The future of work is rapidly becoming the present.  The COVID-19 pandemic has accelerated the recent mass-shift to home working, and it looks to be here to stay.  With this comes a number of challenges for organisations, in particular with technology, risk and legal operations.  

At Deloitte we see changes that will affect data security, customer confidentiality and the detection of employee misconduct.  In helping our clients to respond, we have set out below some of the ways in which this will impact them and their requirements.

1.       There will be a delayed increase in data thefts by employees

 

Working away from the office increases the methods by which data theft can be carried out, including new methods to avoid preventative controls or oversight.  We believe that individuals may initially hesitate to do this given the economic uncertainty, and are not willing to accept the risk of carrying out a risky action which could lead to them being disciplined or dismissed.

 

However, as industry reopens and economic progress starts to return, this could create a situation where more opportunistic data thefts might prevail, be it someone stealing intellectual property in order to get ahead in setting up their own company, joining a competitor, or perhaps a disgruntled employee seeking to cause harm to their employer.

 

2.       Confidentiality breaches will increase, and they will become harder to prove

 

Working outside of an office-based environment allows individuals, authorised or not, to note down confidential and inside information with ease because it is more accessible. Household members could overhear confidential conversations or quite simply employees could write down or capture information using personal devices without being physically seen.

 

Some of these actions are not recorded due to the mode by which the information is being stolen.  Therefore, there is an increased need to focus on preventative and proactive investigation solutions to deter and prevent employees from carrying out malicious actions or accidentally exposing confidential information.

 

3.       Data thefts will increasingly utilise uncommon methods as individuals become more familiar with their home network set-ups.

 

Some methods of data theft may increase as systems being accessed outside of a corporate environment have lesser controls or restrictions.  They may also become more sophisticated as criminal gangs learn how to exploit the new situation.

 

Corporate IT systems may allow those working from home to connect to third-party systems with insufficient oversight.  In particular, data transmittal to an unauthorised location, say, to a home NAS (Network Attached Storage) drive, may become harder to detect or prevent and this will likely lead to a requirement for more thorough and comprehensive analysis in finding evidence of any data theft.

 

4.       Acting as an expert will become more logistically complex

 

In the past, a forensic technology expert might visit one or two office locations and perform a forensic data collection of any evidential assets that require analysis.  In the COVID-19 world, employees are dispersed in different locations. As such, a ten-person data collection in one location could become a ten-location single-person data collection, all of which needs to be carried out at the same time to avoid unlawful or accidental data destruction.

 

Throw in the local public health guidelines and rules, for example social distancing or travel restrictions, and this makes the situation even more challenging.  Some forensic technology teams may not be large enough to handle this and themselves might have staff members unable to travel.

 

5.       There will be an increased need for forensic technology experts to have cross-disciplinary skills

 

The proliferation in remote working technology will drive a demand in skills in analysing those types of technologies to a forensic level.  Together with the continued growth in cloud technologies and the use of mobile devices, it will require forensic technology teams to cover the full gamut of disciplines: operating systems, computers, servers, mobile devices, video calling software, collaboration tools (Teams, Slack etc.), security appliance logs, network traffic and more.

 

No one expert can cover them all but your expert of choice needs to have the expertise within their teams when it comes to technology and forensic analysis in order to handle your investigative needs efficiently and effectively.

Take action now

For any organisation a data theft or any type of digital forensic investigation can be difficult at the best of times.  The first step is to revisit the threats to your organisation and ensure you have the skills and access to expertise needed to better protect your organisation, your data and clients.  Taking action now will help you to be better prepared to react quicker, prevent further reputational or brand damage and respond to any legal or regulatory action with the right expertise and advice.


Did you find this useful?