Working with Law Enforcement and Specialized Prosecutors
Coordinating well with those who have the power to investigate
An organization that's the victim of a cyberattack can investigate internally up to a point, but actions such as intercepting communications, requesting data from foreign providers or executing searches require the involvement of law enforcement and prosecutors with jurisdiction and legal powers no private team has. Building a smooth working relationship with these entities before an incident happens, and not during the crisis, makes an enormous difference in response speed, because teams specialized in computer crimes are usually small and prioritize cases where there's already an established communication channel and well-organized evidence. In practice, handing the prosecutor's office a chaotic technical report, without a clear chain of custody or an understandable narrative of the incident, considerably delays the opening of a formal investigation. Organizations that maintain regular contact with specialized units, take part in information-sharing programs and understand what format of evidence authorities expect achieve noticeably faster investigations when a real incident occurs.