Post #4230693

'Too often, defenders must rely on improvised techniques, reverse engineering, or even zero-day vulnerabilities to understand what happened on a compromised device. 'Encouragingly, we are seeing meaningful progress from parts of the technology industry. Several vendors have begun investing in better logging, forensic data collection capabilities, and greater system transparency. 'To support this shift, the NCSC has been working with international partners to develop a reference architecture for forensic observability in network appliances and similar devices. The goal is to describe a practical approach that vendors can adopt to provide safe, reliable forensic access while maintaining strong security boundaries'. THE EDGE! https://www.ncsc.gov.uk/blogs/making-forensic-observability-the-norm-for-network-devices