If you need Mike Nelson’s services, you’re either a forward-thinking distributor who’s concerned about your digital security or you’re in trouble.
Nelson, a digital forensic expert and founder of Philadelphia-based DFDR Consulting (www.dfdrconsulting.com), bears the job description that seems to be creeping up in media accounts whenever something goes seriously awry with a company’s computer system.
A digital forensic expert unearths tampering with an IT system, according to Nelson. An expert will also be involved in uncovering electronic evidence on a variety of issues ranging from data breaches to security incident investigations.
But why would an HVACR distributor need a forensic expert? “People often tell me that I’ve got an IT person to handle all that stuff,” Nelson says.
He explains that when an IT problem, especially if it concerns security, becomes too large, complex or important, it’s time to call in talent with the white hats. “There are three reasons that companies generally turn to me that center around digital issues that they can’t handle by themselves,” he says.
The first is the departure of an employee who had access to the computer system. “This is particularly important if the employee is disgruntled or left under less than pleasant circumstances,” says Nelson. A distributor should ensure that the employee didn’t steal or share information with a competitor or do something that might harm the computer system. “You don’t want to think that it’ll happen, but it does,” Nelson says.
The second reason is litigation. With greater frequency, attorneys are relying on a digital trail for evidence in legal cases. Not having a firm grasp of what type of digital fingerprint is in your system can be detrimental to your side, whether you are the plaintiff or defendant.
The third reason is a breach in the computer system. This occurs when an outsider tries to compromise the security system of your computer network by invading it for malicious purposes.
An in-house person managing your system might be sufficiently competent to supervise your IT network, but when it comes to the peculiarities and demands of the three scenarios described above, it’s time to call in a specialist.
Nelson likens it to a legal practice. Some lawyers who are generalists have a practice that includes contracts, wills and basic real estate deals. But sometimes you need a lawyer who practices only one type of law, for example, medical malpractice. In the digital forensic field, Nelson urges distributors to ask for certifications and referrals, especially from practitioners who have testified in court.
“If a lawyer who handles these issues recommends a digital forensic expert, you can be confident that they are reliable,” he says.
The best way to avoid calling in someone like Nelson is to have an occasional security audit done in conjunction with your in-house IT person. “We run scenarios and potential breach attempts to see how solid your security is,” Nelson says. “I frequently hear IT people complaining that their pleas for a little extra money to firm up security usually get ignored … until a serious problem arises.”
And while digital issues such as breaches can be complex and confounding to the public, it is employees, not hackers or other IT people, who are often the threat. He says that personnel is invariably the source of a breach by foolishly — sometimes purposely — revealing a code.
Nelson says some of the most publicized breaches against a company were successful because they invaded the target through a vendor or client of the business. When retail giant Target had a highly publicized breach, the entry into their system was through one of its HVAC contractors.
“We might be in a digital world, but it’s still about real people,” he says.
– Tom Peric