Detective acting sergeant Roger Clay told conference delegates that forensics should not be ignored -- improperly collected evidence won't hold up in court.
"If an intrusion occurs, at some point a company has to decide whether to report it to police ... they can ignore it or deal with it internally, proceed civilly, or criminally," he told ZDNet Australia after his presentation. "The evidence they gathered must be ... credible."
"Without planning what to do, companies are leaving themselves open," he said.
While it's important to focus on security and preventative measures, Clay says its not always possible to keep attackers out. "A lot of companies spend a lot of money on keeping attackers out ... the reality is not all attackers stay out."
Australian organisations will have more options available to them when Standards Australia finalises its draft IT evidence management handbook, HB 171. It covers issues such as note taking -- useful if evidence comes under scrutiny "down the track" -- as well as technical standards related to the storage of evidence.
Far from trying to push the burden of evidence collection and management off its own back and on to the private sector, Clay says having a good evidence collection regime will assist in civil and "internal" matters as well.
