Organizations frequently undermine their own corporate investigations by making critical errors in the initial hours of an incident, according to Christine Gadsby, VP and Chief Security Advisor at BlackBerry. These missteps can compromise evidence, privilege, and regulatory standing, as evidenced by over $2 billion in SEC penalties levied against more than 100 financial firms since 2021 for record-keeping failures.
Gadsby identifies four common mistakes that occur before forensic teams are even engaged. The first is approaching an investigation solely as a technical issue rather than a broader business event. This narrow focus can overlook critical aspects beyond system compromise.
A second mistake involves failing to track where sensitive discussions about the incident are taking place. Informal or unrecorded communications can create gaps in the investigative record and complicate later review.
Third, organizations often incorrectly assume they know who is receiving information related to the incident. This lack of verification can lead to unauthorized disclosure or a misunderstanding of the information flow.
Finally, many organizations limit their chain of custody efforts to only devices and logs, neglecting to apply the same rigor to findings, interview records, and executive communications. This oversight can leave significant portions of an investigation undocumented and vulnerable to challenge.
To avoid these pitfalls, Gadsby advises organizations to immediately name an incident commander to lead the response. She also stresses the importance of selecting communication channels that inherently provide an audit trail, verifying the identity and authorization of all participants in sensitive discussions, and meticulously documenting all decisions as they are made throughout the investigation process. These measures help ensure the integrity and defensibility of the entire corporate investigation.
