{"id":1712,"date":"2021-03-24T16:03:03","date_gmt":"2021-03-24T15:03:03","guid":{"rendered":"https:\/\/www.forensee.cz\/?p=1712"},"modified":"2021-06-16T13:26:15","modified_gmt":"2021-06-16T11:26:15","slug":"planovani-forenzniho-zajisteni-dat-navod-na-pripravu","status":"publish","type":"post","link":"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/","title":{"rendered":"Pl\u00e1nov\u00e1n\u00ed forenzn\u00edho zaji\u0161\u0165\u011bn\u00ed dat &#8211; n\u00e1vod na p\u0159\u00edpravu"},"content":{"rendered":"<p>[et_pb_section fb_built=&#8220;1&#8243; admin_label=&#8220;section&#8220; _builder_version=&#8220;4.9.2&#8243; min_height=&#8220;1059px&#8220; custom_margin=&#8220;||67px|||&#8220; custom_margin_tablet=&#8220;||-591px||false|false&#8220; custom_margin_phone=&#8220;||-200px||false|false&#8220; custom_margin_last_edited=&#8220;on|tablet&#8220; custom_padding=&#8220;||123px|||&#8220; hover_enabled=&#8220;0&#8243; sticky_enabled=&#8220;0&#8243;][et_pb_row admin_label=&#8220;row&#8220; _builder_version=&#8220;4.9.2&#8243; background_size=&#8220;initial&#8220; background_position=&#8220;top_left&#8220; background_repeat=&#8220;repeat&#8220; custom_margin=&#8220;-63px||-401px||false|false&#8220; custom_margin_tablet=&#8220;-63px||-3px||false|false&#8220; custom_margin_phone=&#8220;&#8220; custom_margin_last_edited=&#8220;on|tablet&#8220;][et_pb_column type=&#8220;4_4&#8243; _builder_version=&#8220;3.25&#8243; custom_padding=&#8220;|||&#8220; custom_padding__hover=&#8220;|||&#8220;][et_pb_text admin_label=&#8220;Text&#8220; _builder_version=&#8220;3.27.4&#8243; background_size=&#8220;initial&#8220; background_position=&#8220;top_left&#8220; background_repeat=&#8220;repeat&#8220;][\/et_pb_text][et_pb_text admin_label=&#8220;Text&#8220; _builder_version=&#8220;3.27.4&#8243; background_size=&#8220;initial&#8220; background_position=&#8220;top_left&#8220; background_repeat=&#8220;repeat&#8220; custom_padding=&#8220;|||1px||&#8220;]<!-- divi:paragraph --><\/p>\n<p><em>Forenzn\u00ed zaji\u0161t\u011bn\u00ed dat ve firemn\u00edm prost\u0159ed\u00ed v p\u0159\u00edpadech \u0161et\u0159en\u00ed bezpe\u010dnostn\u00edch nebo jin\u00fdch incident\u016f za \u00fa\u010delem z\u00edsk\u00e1n\u00ed d\u016fkaz\u016f m\u00e1 sv\u00e1 \u00faskal\u00ed. Na rozd\u00edl od<\/em><br \/><em>vy\u0161et\u0159ov\u00e1n\u00ed trestn\u00e9 \u010dinnosti polici\u00ed, nen\u00ed v korpor\u00e1tn\u00edm prost\u0159ed\u00ed tato \u010dinnost n\u011bjak explicitn\u011b regulov\u00e1na. T\u00edm v\u011bt\u0161\u00ed pozornost je nutn\u00e9 v\u011bnovat p\u0159\u00edprav\u011b takov\u00fdch<\/em><br \/><em>\u00fakon\u016f. \u010cl\u00e1nek d\u00e1v\u00e1 n\u00e1vod na p\u0159\u00edpravu pl\u00e1nu forenzn\u00edho zaji\u0161t\u011bn\u00ed digit\u00e1ln\u00edch d\u016fkaz\u016f.<\/em> <strong><\/strong><\/p>\n<p><strong>Introduction<\/strong><\/p>\n<p>Org\u00e1ny \u010dinn\u00e9 v trestn\u00edm \u0159\u00edzen\u00ed (O\u010cT\u0158), tedy zejm\u00e9na policie, jsou ze z\u00e1kona opr\u00e1vn\u011bn\u00e9 v od\u016fvodn\u011bn\u00fdch p\u0159\u00edpadech zasahovat do jinak chr\u00e1n\u011bn\u00fdch z\u00e1jm\u016f ob\u010dan\u016f a organizac\u00ed a zaji\u0161\u0165ovat d\u016fkazy (v\u010detn\u011b digit\u00e1ln\u00edch).<br \/>Jin\u00e1 situace je v p\u0159\u00edpad\u011b intern\u00edch \u0161et\u0159en\u00ed bezpe\u010dnostn\u00edch incident\u016f a\/nebo poru\u0161en\u00ed z\u00e1vazn\u00fdch intern\u00edch p\u0159edpis\u016f v organizac\u00edch. I takov\u00e9 negativn\u00ed ud\u00e1losti je nezbytn\u00e9 vy\u0161et\u0159it a pro intern\u00ed vy\u0161et\u0159ov\u00e1n\u00ed je tak\u00e9 nezbytn\u00e9 zajistit (krom\u011b jin\u00fdch i) digit\u00e1ln\u00ed d\u016fkazy. K tomu ale, na rozd\u00edl od vy\u0161et\u0159ov\u00e1n\u00ed trestn\u00e9 \u010dinnosti, nejsou definov\u00e1ny prakticky \u017e\u00e1dn\u00e9 obecn\u011b z\u00e1vazn\u00e9 pr\u00e1vn\u00ed p\u0159edpisy. Je tedy nutn\u00e9 vytvo\u0159it intern\u00ed normy, kter\u00e9 by (krom\u011b jin\u00e9ho) zaji\u0161t\u011bn\u00ed digit\u00e1ln\u00edch d\u016fkaz\u016f ve vymezen\u00fdch p\u0159\u00edpadech a v definovan\u00fdch p\u0159\u00edpadech umo\u017e\u0148ovaly. Nen\u00ed nutn\u00e9 p\u0159ipom\u00ednat, \u017ee takov\u00e9 intern\u00ed p\u0159edpisy mus\u00ed b\u00fdt v souladu s jin\u00fdmi obecn\u011b z\u00e1vazn\u00fdmi normami. <br \/>To je ale ot\u00e1zka sp\u00ed\u0161e na pr\u00e1vn\u00ed posouzen\u00ed. T\u00edm se zab\u00fdvat tady nem\u016f\u017eeme. Budeme vych\u00e1zet z p\u0159edpokladu, \u017ee takov\u00e9 intern\u00ed p\u0159edpisy existuj\u00ed. V ka\u017ed\u00e9m p\u0159\u00edpad\u011b z nich asi mus\u00ed vypl\u00fdvat, \u017ee v r\u00e1mci organizace je ur\u010dena kompetentn\u00ed pov\u011b\u0159en\u00e1 osoba, kter\u00e1 je opr\u00e1vn\u011bn\u00e1 rozhodnout a schv\u00e1lit kdy, kdo, v jak\u00fdch situac\u00edch, v jak\u00e9m rozsahu a jak\u00fdm zp\u016fsobem m\u016f\u017ee forenzn\u011b zaji\u0161\u0165ovat digit\u00e1ln\u00ed d\u016fkazy z prost\u0159edk\u016f v\u00fdpo\u010detn\u00ed techniky organizace.<\/p>\n<p><strong>P\u0159edpoklady <\/strong><\/p>\n<p>\u00da\u010delem tohoto \u010dl\u00e1nku je popsat dle mo\u017enost\u00ed v\u0161echny relevantn\u00ed vstupn\u00ed informace, kter\u00e9 je nutn\u00e9 zv\u00e1\u017eit pro rozhodovac\u00ed procesy v p\u0159\u00edpad\u011b nutnosti zaji\u0161t\u011bn\u00ed digit\u00e1ln\u00edch dat pro \u00fa\u010dely dal\u0161\u00edho (i forenzn\u00edho) zkoum\u00e1n\u00ed v p\u0159\u00edpad\u011b jak\u00fdchkoliv (zejm\u00e9na bezpe\u010dnostn\u00edch) incident\u016f. Dal\u0161\u00edm d\u016fvodem je v\u00fdb\u011br relevantn\u00edch informac\u00ed a dal\u0161\u00edch podklad\u016f o z\u00e1m\u011bru realizace zaji\u0161t\u011bn\u00ed dat pro \u00fa\u010dely rozhodovac\u00edch proces\u016f na r\u016fzn\u00fdch \u00farovn\u00edch rozhodov\u00e1n\u00ed (nap\u0159. na \u00farovni CIRT\/CERT, vedouc\u00edch dot\u010den\u00fdch organiza\u010dn\u00edch celk\u016f, intern\u00edho auditu, informa\u010dn\u00ed bezpe\u010dnosti apod.). <br \/>Je nutn\u00e9 p\u0159edeslat, \u017ee ne v\u0161echny zde uveden\u00e9 parametry a vstupn\u00ed informace pro rozhodov\u00e1n\u00ed o zaji\u0161t\u011bn\u00ed dat jsou nezbytn\u011b nutn\u00e9. Je z\u0159ejm\u00e9, \u017ee slo\u017een\u00ed a z\u00e1va\u017enost (v\u00e1ha) jednotliv\u00fdch d\u00e1le uveden\u00fdch parametr\u016f v\u00fdznamn\u011b z\u00e1vis\u00ed od aktu\u00e1ln\u00ed situace, rozsahu a obsahu jednotliv\u00fdch \u0161et\u0159en\u00fdch incident\u016f a aktu\u00e1ln\u00edch pot\u0159eb. Tak\u00e9 je nutn\u00e9 si uv\u011bdomit, \u017ee tento n\u00e1vod nem\u016f\u017ee v \u017e\u00e1dn\u00e9m p\u0159\u00edpad\u011b obs\u00e1hnout v\u0161echny situace a typy incident\u016f a ani s t\u00edm souvisej\u00edc\u00ed parametry, kter\u00e9 v n\u011bkter\u00fdch situac\u00edch mohou i zna\u010dn\u011b vybo\u010dit z toho, co je zde uvedeno. <br \/>Tento \u010dl\u00e1nek je tedy pouze orienta\u010dn\u00edm vod\u00edtkem ke sb\u011bru a vyhodnocen\u00ed relevantn\u00edch informac\u00ed pro pl\u00e1nov\u00e1n\u00ed a realizaci zaji\u0161t\u011bn\u00ed dat v procesu \u0161et\u0159en\u00ed\/vy\u0161et\u0159ov\u00e1n\u00ed bezpe\u010dnostn\u00edch incident\u016f v podm\u00ednk\u00e1ch organizace a <strong>pro rozhodovac\u00ed procesy<\/strong> o tom, zda a jak realizovat forenzn\u00ed zaji\u0161t\u011bn\u00ed dat. <br \/>Je d\u00e1le tak\u00e9 <strong>vod\u00edtkem pro p\u0159\u00edpravu pl\u00e1nu zaji\u0161t\u011bn\u00ed<\/strong>, kter\u00fd by m\u011bl b\u00fdt alespo\u0148 v z\u00e1kladn\u00edm r\u00e1mci p\u0159ipraven pro p\u0159\u00edpad, \u017ee forenzn\u00ed zaji\u0161t\u011bn\u00ed dat bude odsouhlaseno na vy\u0161\u0161\u00edch \u0159\u00edd\u00edc\u00edch stupn\u00edch a samotn\u00e9 zaji\u0161t\u011bn\u00ed by m\u011blo prob\u011bhnout v souladu s takov\u00fdm rozhodnut\u00edm a tak\u00e9 v souladu s best practices pro forenzn\u00ed pr\u00e1ci. <br \/>To zajist\u00ed nejenom korektn\u00ed v\u00fdsledek zaji\u0161t\u011bn\u00ed dat z pohledu technick\u00e9ho a forenzn\u00edho, ale i z pohledu procesn\u00edho tak, aby potenci\u00e1ln\u00ed negativn\u00ed dopady na organizaci byly minimalizov\u00e1ny, resp. aby samotn\u00e9 zaji\u0161t\u011bn\u00ed nevyvolalo \u017e\u00e1dn\u00e9 dodate\u010dn\u00e9 dopady. Naopak, aby takov\u00e9 procesy a postupy maxim\u00e1ln\u011b p\u0159isp\u011bly k \u00fasp\u011b\u0161n\u00e9mu \u0159e\u0161en\u00ed (vy\u0161et\u0159en\u00ed) p\u0159edm\u011btn\u00e9ho incidentu.<br \/>Zaji\u0161t\u011bn\u00ed dat z po\u010d\u00edta\u010de\/po\u010d\u00edta\u010d\u016f, na kter\u00fdch se nach\u00e1zej\u00ed potenci\u00e1ln\u00ed d\u016fkazy o vy\u0161et\u0159ovan\u00e9m incidentu, se prov\u00e1d\u00ed v p\u0159\u00edpadech vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f zejm\u00e9na vysok\u00e9 priority. Potenci\u00e1ln\u011b m\u016f\u017ee zasahovat do citliv\u00fdch nebo osobn\u00edch dat u\u017eivatele\/u\u017eivatel\u016f po\u010d\u00edta\u010d\u016f, proto je takovou aktivitu nezbytn\u00e9 p\u0159edem dle existuj\u00edc\u00edch mo\u017enost\u00ed d\u016fkladn\u011b p\u0159ipravit. K tomu existuje z\u00e1kladn\u00ed pl\u00e1n zaji\u0161t\u011bn\u00ed, pro kter\u00fd je nutn\u00e9 zjistit co nejv\u00edce relevantn\u00edch vstup\u016f a kter\u00fd je nezbytn\u00e9 (alespo\u0148 jeho podstatnou \u010d\u00e1st) schv\u00e1lit odpov\u011bdnou osobou. <br \/><strong><em>Tento \u010dl\u00e1nek obsahuje n\u00e1vrh z\u00e1kladn\u00edch parametr\u016f pl\u00e1nu forenzn\u00edho zaji\u0161t\u011bn\u00ed dat, kter\u00e9 jsou d\u016fle\u017eit\u00e9 nebo dokonce rozhoduj\u00edc\u00ed pro fin\u00e1ln\u00ed schv\u00e1len\u00ed takov\u00e9ho pl\u00e1nu.<\/em><\/strong><\/p>\n<p><strong>Osobn\u00ed odpov\u011bdnost <\/strong><\/p>\n<p>Pro rozhodov\u00e1n\u00ed o realizaci pl\u00e1nu zaji\u0161t\u011bn\u00ed dat je z\u00e1kladn\u00edm po\u017eadavkem stanoven\u00ed osobn\u00ed odpov\u011bdnosti za jeho realizaci. <br \/>Obecn\u011b je odpov\u011bdnou osobou zpravidla pracovn\u00edk, kter\u00fd by m\u011bl b\u00fdt v roli hlavn\u00edho vy\u0161et\u0159ovatele incidentu. \u010casto je takovou osobou pracovn\u00edk intern\u00edho auditu, opera\u010dn\u00edch rizik, \u00fatvaru bezpe\u010dnosti nebo obdobn\u011b postaven\u00fdch \u00fatvar\u016f organizace. <br \/>Je vhodn\u00e9 a dokonce i nezbytn\u00e9, aby m\u011bl podporu ze strany technologi\u00ed (pov\u011b\u0159en\u00e1 osoba z IT nebo IT Security) a pr\u00e1vn\u00ed podporu z pr\u00e1vn\u00edho odd\u011blen\u00ed.<\/p>\n<p><strong><em>Pr\u00e1vn\u00ed podpora <\/em><\/strong><\/p>\n<p>Pr\u00e1vn\u00ed podpora zaji\u0161\u0165uje procesn\u00ed a pr\u00e1vn\u00ed aspekty zaji\u0161t\u011bn\u00ed dat. <br \/>Zejm\u00e9na se zab\u00fdv\u00e1 problematikou opr\u00e1vn\u011bnosti zaji\u0161\u0165ovac\u00edho \u00fakonu ve vztahu k charakteru incidentu, souladu s obecn\u011b z\u00e1vazn\u00fdmi pr\u00e1vn\u00edmi p\u0159edpisy, vlastnictv\u00edm zaji\u0161\u0165ovan\u00fdch dat (tj. jestli m\u00e1 organizace opr\u00e1vn\u011bn\u00ed s daty pracovat), rozhoduje o p\u0159\u00edpadn\u00e9m pou\u017eit\u00ed priv\u00e1tn\u00edch dat u\u017eivatele v procesu \u0161et\u0159en\u00ed incidentu, zaji\u0161\u0165uje sou\u010dinnost v p\u0159\u00edpadech, kdy za\u0159\u00edzen\u00ed nebo data nejsou ve vlastnictv\u00ed organizace apod.<\/p>\n<p><strong><em>Technick\u00e1 podpora<\/em><\/strong><\/p>\n<p>Technick\u00e1 podpora zaji\u0161\u0165uje samotnou realizaci zaji\u0161\u0165ovac\u00edho \u00fakonu. <br \/>Zpravidla tuto podporu realizuje \u00fatvar IT Security p\u0159\u00edmo s\u00e1m (kdy\u017e m\u00e1 k takov\u00fdm \u010dinnostem kvalifikaci a person\u00e1l) p\u0159\u00edpadn\u011b v sou\u010dinnosti s jin\u00fdmi technick\u00fdmi a provozn\u00edmi \u00fatvary organizace. V p\u0159\u00edpad\u011b pot\u0159eby (nebo po\u017eadavku vy\u0161et\u0159ovatele) zaji\u0161\u0165uje sou\u010dinnost p\u0159i realizaci zaji\u0161t\u011bn\u00ed dat extern\u00edmi dodavateli speci\u00e1ln\u00edch forenzn\u00edch slu\u017eeb nebo v\u00a0sou\u010dinnosti s\u00a0jin\u00fdmi technick\u00fdmi a provozn\u00edmi \u00fatvary organizace. <br \/>V p\u0159\u00edpad\u011b pot\u0159eby (nebo po\u017eadavku vy\u0161et\u0159ovatele) zaji\u0161\u0165uje sou\u010dinnost p\u0159i realizaci zaji\u0161t\u011bn\u00ed dat extern\u00edmi dodavateli speci\u00e1ln\u00edch forenzn\u00edch slu\u017eeb nebo v\u00a0sou\u010dinnosti s\u00a0O\u010cT\u0158 a jejich specialisty.<\/p>\n<p><strong><em>Zd\u016fvodn\u011bn\u00ed<\/em><\/strong><\/p>\n<p>Ve zd\u016fvodn\u011bn\u00ed by m\u011bl b\u00fdt stru\u010dn\u011b uveden z\u00e1kladn\u00ed d\u016fvod(y) po\u017eadavku na realizaci zaji\u0161t\u011bn\u00ed dat tak, aby bylo jednozna\u010dn\u011b z\u0159ejm\u00e9, pro\u010d je nutn\u00e9 forenzn\u00ed zaji\u0161t\u011bn\u00ed dat realizovat. <br \/>Sou\u010dasn\u011b je pot\u0159ebn\u00e9 vyjasnit, jak\u00e9 informace pro vy\u0161et\u0159ov\u00e1n\u00ed je nezbytn\u00e9 z\u00edskat a s jakou pravd\u011bpodobnost\u00ed lze o\u010dek\u00e1vat, \u017ee bude mo\u017en\u00e9 je v zaji\u0161t\u011bn\u00fdch datech potenci\u00e1ln\u011b nal\u00e9zt. <br \/>Forma zd\u016fvodn\u011bn\u00ed m\u016f\u017ee b\u00fdt r\u016fzn\u00e1 v z\u00e1vislosti na informa\u010dn\u00edm obsahu z\u00e1znam\u016f v intern\u00edch evidenc\u00edch vy\u0161et\u0159ovan\u00fdch ud\u00e1lost\u00ed (lze vyu\u017e\u00edt intern\u00ed registr incident\u016f, z\u00e1znam v HelpDesku, nebo jak\u00fdkoliv relevantn\u00ed intern\u00ed informa\u010dn\u00ed syst\u00e9m) dopln\u011bna o stru\u010dn\u00fd popis d\u016fvod\u016f.<br \/><strong>Podstatn\u00e9 je, aby osoba, kter\u00e1 o forenzn\u00edm zaji\u0161t\u011bn\u00ed dat rozhoduje, m\u011bla dostatek informac\u00ed k tomu, aby shledala forenzn\u00ed zaji\u0161t\u011bn\u00ed dat dostate\u010dn\u011b zd\u016fvodn\u011bn\u00e9.<\/strong><\/p>\n<p><strong>Potenci\u00e1ln\u00ed dopady\/rizika<\/strong><\/p>\n<p>Jedn\u00e1 se o popis potenci\u00e1ln\u00edch dopad\u016f realizace zaji\u0161\u0165ovac\u00edch \u00fakon\u016f. Nejedn\u00e1 se tedy o hodnocen\u00ed dopad\u016f samotn\u00e9ho vy\u0161et\u0159ovan\u00e9ho incidentu, ale dopad\u016f, kter\u00e9 mohou vzniknout p\u0159i realizaci zaji\u0161t\u011bn\u00ed dat. <br \/>Je z\u0159ejm\u00e9, \u017ee z d\u016fvod\u016f zaji\u0161t\u011bn\u00ed dat mohou vzniknout \u010dasov\u00e9 prodlevy p\u0159i vyu\u017eit\u00ed po\u010d\u00edta\u010de, prostoje v pr\u00e1ci, p\u0159\u00edpadn\u011b dopady na organizaci v situaci, kdy by se jednalo o citliv\u00e1 nebo osobn\u00ed data u\u017eivatele(\u016f) po\u010d\u00edta\u010de nebo data klient\u016f.<\/p>\n<p><strong><em>Dopad na provoz<\/em><\/strong><\/p>\n<p>V z\u00e1vislosti od zp\u016fsobu realizace zaji\u0161t\u011bn\u00ed dat m\u016f\u017ee doj\u00edt k odstaven\u00ed zaji\u0161\u0165ovan\u00e9 techniky z provozu na dobu samotn\u00e9ho zaji\u0161t\u011bn\u00ed, kter\u00e1 z\u00e1vis\u00ed zejm\u00e9na od objemu zaji\u0161\u0165ovan\u00fdch dat. Do \u00favahy je nutn\u00e9 zapo\u010d\u00edtat tak\u00e9 potenci\u00e1ln\u00ed riziko vzniku technick\u00fdch probl\u00e9m\u016f, kter\u00e9 mohou zaji\u0161\u0165ovac\u00ed \u00fakon i v\u00fdrazn\u011b prodlou\u017eit. <br \/>V p\u0159\u00edpad\u011b, kdy se bude zaji\u0161\u0165ovat jen samotn\u00e1 technika k proveden\u00ed forenzn\u00edch kopi\u00ed dat na specializovan\u00e9m pracovi\u0161ti organizace nebo na extern\u00edm forenzn\u00edm pracovi\u0161ti (potenci\u00e1ln\u011b i na pracovi\u0161ti Policie \u010cR) je nezbytn\u00e9 zapo\u010d\u00edtat relevantn\u00ed prodlen\u00ed a zv\u00e1\u017eit n\u00e1hradn\u00ed opat\u0159en\u00ed pro eliminaci omezen\u00ed provozu dot\u010den\u00e9ho pracovi\u0161t\u011b\/pracovn\u00edka.<\/p>\n<p><strong><em>Dopad na klienty organizace <\/em><\/strong><\/p>\n<p>Je nutn\u00e9 zv\u00e1\u017eit a p\u0159\u00edpadn\u011b se vyj\u00e1d\u0159it k p\u0159\u00edpad\u016fm, kdy by mohlo m\u00edt zaji\u0161t\u011bn\u00ed dopad na klienty organizace. <br \/>M\u016f\u017ee se jednat o realizaci dodate\u010dn\u00fdch opat\u0159en\u00ed v p\u0159\u00edpad\u011b, kdy by se jednalo o zaji\u0161t\u011bn\u00ed dat, obsahuj\u00edc\u00edch klientsk\u00e1 data, zaji\u0161t\u011bn\u00ed dat z klientsk\u00e9ho po\u010d\u00edta\u010de (nap\u0159. v p\u0159\u00edpad\u011b \u0161et\u0159en\u00ed kompromitace klientsk\u00e9 stanice), p\u0159\u00edpadn\u011b p\u0159eru\u0161en\u00ed slu\u017eby klient\u016fm z d\u016fvod\u016f zaji\u0161\u0165ov\u00e1n\u00ed z techniky, kter\u00e1 m\u00e1 vliv na realizaci slu\u017eeb pro klienty.<\/p>\n<p><strong><em>Dopad na t\u0159et\u00ed strany<\/em><\/strong><\/p>\n<p>Zaji\u0161t\u011bn\u00ed dat m\u016f\u017ee m\u00edt potenci\u00e1ln\u00ed dopad na t\u0159et\u00ed strany, zejm\u00e9na v p\u0159\u00edpad\u011b smluvn\u00edch z\u00e1vazk\u016f s nimi. Nap\u0159\u00edklad nutnost \u017e\u00e1dat o sou\u010dinnost a p\u0159\u00edpadn\u011b i v\u00edcen\u00e1klady p\u0159i zaji\u0161t\u011bn\u00ed dat z techniky, kterou m\u00e1 organizace v pron\u00e1jmu se zaji\u0161t\u011bn\u00fdm servisem.<\/p>\n<p><strong>Rozsah dat<\/strong><\/p>\n<p>P\u0159edpokl\u00e1dan\u00e9 zaji\u0161t\u011bn\u00ed dat m\u016f\u017ee zahrnovat zaji\u0161t\u011bn\u00ed z jednoho po\u010d\u00edta\u010de jednoho u\u017eivatele, ale i z n\u011bkolika po\u010d\u00edta\u010d\u016f n\u011bkolika u\u017eivatel\u016f, resp. u\u017eivatelsk\u00fdch dat jednoho nebo n\u011bkolika u\u017eivatel\u016f ze sd\u00edlen\u00fdch datov\u00fdch \u00falo\u017ei\u0161\u0165. <br \/>Takov\u00e1 variabilita rozsahu zaji\u0161t\u011bn\u00ed dat m\u016f\u017ee m\u00edt vliv na parametry procesu zaji\u0161t\u011bn\u00ed jak z pohledu dopad\u016f na provoz, tak na celkovou dobu a na person\u00e1ln\u00ed a technick\u00e9 n\u00e1klady, kter\u00e9 zaji\u0161\u0165ovac\u00ed proces vy\u017eaduje. <br \/><strong>P\u0159edpokl\u00e1dan\u00fd rozsah zaji\u0161\u0165ovan\u00fdch dat je jedn\u00edm ze z\u00e1kladn\u00edch a ur\u010duj\u00edc\u00edch parametr\u016f cel\u00e9ho procesu zaji\u0161t\u011bn\u00ed dat. <\/strong><br \/>D\u016fle\u017eit\u00fdm parametrem, kter\u00fd ovlivn\u00ed nejenom technickou str\u00e1nku procesu, ale i procesn\u00ed a pr\u00e1vn\u00ed opodstatn\u011bnost, je potenci\u00e1ln\u00ed po\u017eadavek na zaji\u0161t\u011bn\u00ed nejenom dat z po\u010d\u00edta\u010de, ale i dal\u0161\u00edch potenci\u00e1ln\u00edch datov\u00fdch nosi\u010d\u016f \u2013 extern\u00ed s\u00ed\u0165ov\u00e9 \u00falo\u017ei\u0161t\u011b, extern\u00ed disky, USB za\u0159\u00edzen\u00ed a dal\u0161\u00ed u\u017eivateli dostupn\u00e1 datov\u00e1 \u00falo\u017ei\u0161t\u011b, p\u0159\u00edpadn\u011b e\u2011mailov\u00e9 schr\u00e1nky.<\/p>\n<p><strong>Jak je lze prov\u00e9st? <\/strong><\/p>\n<p>V z\u00e1vislosti od charakteru vy\u0161et\u0159ovan\u00e9ho incidentu lze v z\u00e1sad\u011b rozli\u0161it dva zp\u016fsoby zaji\u0161t\u011bn\u00ed dat \u2013 otev\u0159en\u011b a skryt\u011b.<\/p>\n<ul>\n<li><strong>Otev\u0159en\u00e9 zaji\u0161t\u011bn\u00ed dat<\/strong> prob\u00edh\u00e1 s v\u011bdom\u00edm u\u017eivatele nebo vlastn\u00edka zaji\u0161\u0165ovan\u00fdch dat. Podle okolnost\u00ed, kter\u00e9 z\u00e1vis\u00ed na charakteru vy\u0161et\u0159ovan\u00e9ho p\u0159\u00edpadu\/incidentu, tak\u00e9 s v\u011bdom\u00edm dal\u0161\u00edch relevantn\u00edch osob (nap\u0159. nad\u0159\u00edzen\u00ed pracovn\u00edci, kolegov\u00e9 apod.). P\u0159i otev\u0159en\u00e9m zaji\u0161t\u011bn\u00ed dat je nutn\u00e9 zv\u00e1\u017eit, kdo dal\u0161\u00ed krom\u011b u\u017eivatele nabo vlastn\u00edka zaji\u0161\u0165ovan\u00fdch dat m\u00e1 nebo mus\u00ed b\u00fdt o takov\u00e9m procesu informov\u00e1n. P\u0159\u00edpadn\u011b je nutn\u00e9 zv\u00e1\u017eit i okolnosti, p\u0159i kter\u00fdch by m\u011bl b\u00fdt o \u00fakonu informov\u00e1ny i dal\u0161\u00ed subjekty a jestli a kdo dal\u0161\u00ed mus\u00ed k takov\u00e9 \u010dinnosti ud\u011blit dodate\u010dn\u00fd souhlas.<\/li>\n<li><strong>Skryt\u00e9 zaji\u0161t\u011bn\u00ed dat<\/strong> (nap\u0159. pomoc\u00ed n\u00e1stroje F\u2011Response) prob\u00edh\u00e1 bez v\u011bdom\u00ed u\u017eivatele (vlastn\u00edka) dat. D\u00e1 se to p\u0159irovnat k pou\u017eit\u00ed honey-potu v p\u0159\u00edpad\u011b identifikace \u00fatoku, kdy je z pohledu strategie vy\u0161et\u0159ov\u00e1n\u00ed nutn\u00e9 nechat u\u017eivatele pracovat nebo kdy je nutn\u00e9, aby u\u017eivatel nev\u011bd\u011bl, \u017ee prob\u00edh\u00e1 jeho vy\u0161et\u0159ov\u00e1n\u00ed. P\u0159i skryt\u00e9m zaji\u0161t\u011bn\u00ed dat o procesu za\u2011 ji\u0161t\u011bn\u00ed by u\u017eivatel\/vlastn\u00edk dat o \u00fakonu v\u011bd\u011bt nem\u011bl. Je nutn\u00e9 ale zv\u00e1\u017eit, zda o tom m\u00e1 v\u011bd\u011bt nad\u0159\u00edzen\u00fd osoby nebo dal\u0161\u00ed osoby (nap\u0159. vy\u0161\u0161\u00ed management). Toto posouzen\u00ed je na vedouc\u00edm \u0161et\u0159en\u00ed (vy\u0161et\u0159ovatel) s relevantn\u00ed pr\u00e1vn\u00ed podporou.<\/li>\n<\/ul>\n<p><strong>Jak rychle?<\/strong><\/p>\n<p>Obecn\u011b plat\u00ed, \u017ee zaji\u0161t\u011bn\u00ed dat m\u00e1 prob\u011bhnout tak rychle, jak to je jen mo\u017en\u00e9. Digit\u00e1ln\u00ed d\u016fkazy, kter\u00e9 je pot\u0159ebn\u00e9 zajistit, mohou m\u00edt toti\u017e obecn\u011b velice kr\u00e1tkou \u017eivotnost a ka\u017ed\u00e9 zdr\u017een\u00ed jejich zaji\u0161t\u011bn\u00ed m\u016f\u017ee zp\u016fsobit jejich nen\u00e1vratnou ztr\u00e1tu. <br \/>Nicm\u00e9n\u011b mohou existovat p\u0159\u00edpady, kter\u00e9 lze z pohledu strategie vy\u0161et\u0159ov\u00e1n\u00ed pova\u017eovat za urgentn\u00ed. <br \/>S m\u00edrou urgentnosti souvis\u00ed n\u011bkolik dal\u0161\u00edch aspekt\u016f, nap\u0159.:<\/p>\n<ul>\n<li>potenci\u00e1ln\u00ed v\u00edcen\u00e1klady na cel\u00fd proces jak z pohledu person\u00e1ln\u00edch n\u00e1klad\u016f (pr\u00e1ce mimo pracovn\u00ed dobu nebo pr\u00e1ce nad r\u00e1mec pracovn\u00ed doby, urgentn\u00ed vyu\u017eit\u00ed extern\u00ed podpory apod.), tak z pohledu technick\u00e9ho (nutnost urychlen\u011b po\u0159\u00eddit nebo zap\u016fj\u010dit specifickou technologii, a tedy schv\u00e1lit mimo\u0159\u00e1dnou investici apod.),<\/li>\n<li>potenci\u00e1ln\u00ed probl\u00e9m v dodr\u017een\u00ed v\u0161ech p\u0159edpokl\u00e1dan\u00fdch form\u00e1ln\u00edch krok\u016f, jako je nap\u0159. informov\u00e1n\u00ed\/souhlas relevantn\u00edch nad\u0159\u00edzen\u00fdch dan\u00e9ho u\u017eivatele dat.<\/li>\n<\/ul>\n<p><strong>Zd\u016fvodn\u011bn\u00ed urgentnosti -\u00ad definice \u010dasov\u00e9 urgentnosti<\/strong><\/p>\n<p>Pro po\u017eadavek na urgentn\u00ed zaji\u0161t\u011bn\u00ed mus\u00ed existovat relevantn\u00ed d\u016fvody, zejm\u00e9na hrozba zni\u010den\u00ed d\u016fkaz\u016f, resp. pot\u0159eba zajistit d\u016fkaz ve stanoven\u00e9m \u010dase (nap\u0159. v noci), kter\u00fd neumo\u017e\u0148uje zaji\u0161t\u011bn\u00ed dat standardn\u00edm zp\u016fsobem. <br \/>Po\u017eadavek na urgentnost mus\u00ed b\u00fdt zd\u016fvodn\u011bn postupem vy\u0161et\u0159ov\u00e1n\u00ed a okolnostmi dan\u00e9ho p\u0159\u00edpadu. <br \/>P\u0159i urgentn\u00edm zaji\u0161t\u011bn\u00ed je nezbytn\u00e9 zajistit proces zaji\u0161t\u011bn\u00ed na z\u00e1klad\u011b v\u00fdjime\u010dn\u00fdch kompetenc\u00ed, kter\u00e9 stanovuj\u00ed v\u00fdjimky z postup\u016f, kter\u00e9 se b\u011b\u017en\u011b pou\u017e\u00edvaj\u00ed. M\u016f\u017ee se jednat nap\u0159. o:<\/p>\n<ul>\n<li>prominut\u00ed standardn\u00edch postup\u016f, kdy je nutn\u00fd souhlas se zaji\u0161t\u011bn\u00edm od relevantn\u00edch subjekt\u016f (nap\u0159. nad\u0159\u00edzen\u00fd pracovn\u00edka, u kter\u00e9ho m\u00e1 zaji\u0161t\u011bn\u00ed dat prob\u011bhnout)<\/li>\n<li>ud\u011blen\u00ed souhlasu s potenci\u00e1ln\u00edmi v\u00edcen\u00e1klady, kter\u00e9 s urgentn\u00edm zaji\u0161t\u011bn\u00edm souvis\u00ed<\/li>\n<li>souvisej\u00edc\u00ed po\u017eadavky na pr\u00e1ci p\u0159es\u010das nebo pr\u00e1ci mimo pracovn\u00ed dobu dot\u010den\u00fdch zam\u011bstnanc\u016f<\/li>\n<\/ul>\n<p><strong>P\u0159edpokl\u00e1dan\u00fd \u010dasov\u00fd pl\u00e1n<\/strong><\/p>\n<p>Ka\u017ed\u00fd pl\u00e1n zaji\u0161t\u011bn\u00ed dat mus\u00ed m\u00edt alespo\u0148 orienta\u010dn\u00ed odhad \u010dasov\u00e9ho harmonogramu, za\u010d\u00e1tek zaji\u0161t\u011bn\u00ed a odhad \u010dasov\u00e9ho pr\u016fb\u011bhu i v souvislosti s odhadem dopad\u016f (zejm\u00e9na vy\u010dlen\u011bn\u00ed specialist\u016f na zaji\u0161t\u011bn\u00ed, odstaven\u00ed zaji\u0161\u0165ovan\u00e9 techniky z provozu apod.)<\/p>\n<p><strong>Kdo provede?<\/strong><\/p>\n<p>Pro zaji\u0161t\u011bn\u00ed dat je d\u016fle\u017eit\u00e9 zhodnotit charakter \u0161et\u0159en\u00e9ho p\u0159\u00edpadu, p\u0159edpokl\u00e1danou technickou slo\u017eitost samotn\u00e9ho procesu, rozsah zaji\u0161t\u011bn\u00ed, po\u017eadavky na urgentnost a po\u017eadavky na kvalifikaci osob, kter\u00e9 budou zaji\u0161t\u011bn\u00ed dat realizovat. <br \/>Zejm\u00e9na v p\u0159\u00edpadech, kdy by se potenci\u00e1ln\u011b mohlo jednat o p\u0159\u00edpad, kter\u00fd sv\u00fdm charakterem m\u016f\u017ee p\u0159es\u00e1hnout prost\u0159ed\u00ed dan\u00e9 organizace nebo se vyzna\u010duje zna\u010dnou citlivost\u00ed nebo d\u016fle\u017eitost\u00ed, je doporu\u010deno obr\u00e1tit se s realizac\u00ed procesu zaji\u0161t\u011bn\u00ed na kvalifikovan\u00e9ho extern\u00edho dodavatele (prim\u00e1rn\u011b se p\u0159edpokl\u00e1d\u00e1 kvalifikovan\u00fd soudn\u00ed znalec) a vyhnout se tak potenci\u00e1ln\u00edmu na\u0159\u010den\u00ed z podjatosti.<\/p>\n<p><strong><em>Intern\u00ed team<\/em><\/strong><\/p>\n<p>Ve v\u0161ech standardn\u00edch situac\u00edch by m\u011bl zaji\u0161t\u011bn\u00ed dat realizovat intern\u00ed team organizace, kter\u00fd je pro forenzn\u00ed zaji\u0161t\u011bn\u00ed dat pro\u0161kolen a m\u00e1 odpov\u00eddaj\u00edc\u00ed kvalifikaci a p\u0159\u00edpadn\u011b certifikaci. <br \/>Pro realizaci zaji\u0161t\u011bn\u00ed intern\u00edm teamem je v r\u00e1mci pl\u00e1nu zaji\u0161t\u011bn\u00ed nutn\u00e9:<\/p>\n<ul>\n<li>ur\u010dit vedouc\u00edho zaji\u0161t\u011bn\u00ed, kter\u00fd odpov\u00edd\u00e1 za technickou realizaci \u00fakonu,<\/li>\n<li>ur\u010dit dal\u0161\u00ed \u010dleny teamu \u2011 p\u0159i forenzn\u00edm zaji\u0161t\u011bn\u00ed dat plat\u00ed pravidlo \u010dty\u0159 o\u010d\u00ed.<\/li>\n<\/ul>\n<p><strong><em>Extern\u00ed dodavatel<\/em><\/strong> <br \/>Za extern\u00edho dodavatele zaji\u0161\u0165ovac\u00edch \u00fakon\u016f lze pova\u017eovat subjekt s odpov\u00eddaj\u00edc\u00ed kvalifikac\u00ed (soudn\u00ed znalec) a technick\u00fdmi a person\u00e1ln\u00edmi kapacitami. Zaji\u0161t\u011bn\u00ed dat extern\u00edm dodavatelem je doporu\u010deno prim\u00e1rn\u011b v p\u0159\u00edpadech:<\/p>\n<ul>\n<li>charakter p\u0159\u00edpadu vy\u017eaduje vylou\u010dit podez\u0159en\u00ed z podjatosti (p\u0159\u00edpad m\u016f\u017ee p\u0159es\u00e1hnout hranice organizace).<\/li>\n<li>p\u0159edpokl\u00e1dan\u00e1 slo\u017eitost technologi\u00ed nebo jej\u00ed nestandardn\u00ed vlastnosti neumo\u017e\u0148uj\u00ed realizaci procesu intern\u00edm teamem, intern\u00ed team nem\u00e1 k tomu speci\u00e1ln\u00ed technologick\u00e9 vybaven\u00ed nebo kvalifikaci<\/li>\n<li>rozsah zaji\u0161t\u011bn\u00ed je mimo schopnosti intern\u00edho teamu<\/li>\n<\/ul>\n<p><strong><em>Kombinace (intern\u00ed + extern\u00ed)<\/em><\/strong><\/p>\n<p>Kombinaci extern\u00edho a intern\u00edho realiza\u010dn\u00edho teamu lze p\u0159edpokl\u00e1dat p\u0159i kombinaci podm\u00ednek uveden\u00fdch v\u00fd\u0161e a tak\u00e9 v situaci, kdy se p\u0159edpokl\u00e1d\u00e1 zaji\u0161t\u011bn\u00ed v n\u011bkolika lokalit\u00e1ch ve stejnou dobu a intern\u00ed team by nebyl schopen to person\u00e1ln\u011b a\/nebo technicky zajistit.<\/p>\n<p><strong><em>Policie<\/em><\/strong><\/p>\n<p>V specifick\u00fdch p\u0159\u00edpadech (nap\u0159. na z\u00e1klad\u011b po\u017eadavku t\u0159et\u00ed strany) lze p\u0159edpokl\u00e1dat, \u017ee zaji\u0161t\u011bn\u00ed dat by mohlo b\u00fdt realizov\u00e1no experty Policie \u010cR. V\u00a0takov\u00e9m p\u0159\u00edpad\u011b je nutn\u00e9 po\u017eadovat:<\/p>\n<ul>\n<li>\u00fa\u010dast specialisty organizace (nebo pov\u011b\u0159en\u00e9ho externisty) na zaji\u0161\u0165ovac\u00edch \u00fakonech v roli pozorovatele. Jeho \u00fakolem je (pro intern\u00ed pot\u0159eby organizace) podrobn\u011b dokumentovat takov\u00fd proces zaji\u0161t\u011bn\u00ed.<\/li>\n<li>dal\u0161\u00ed forenzn\u00ed kopii zaji\u0161t\u011bn\u00fdch dat pro pot\u0159eby intern\u00edho vyhodnocen\u00ed.<\/li>\n<\/ul>\n<p><strong>Co zajistit?<\/strong><\/p>\n<p>Z\u00e1kladn\u00edm pravidlem zaji\u0161t\u011bn\u00ed dat je, \u017ee samotn\u00e9 zaji\u0161t\u011bn\u00ed (forenzn\u00ed kopie dat z origin\u00e1ln\u00edch datov\u00fdch nosi\u010d\u016f) se neprov\u00e1d\u00ed mimo kontrolovan\u00e9 prost\u0159ed\u00ed pracovi\u0161t\u011b\/laborato\u0159e. Prim\u00e1rn\u011b se tedy zaji\u0161\u0165uj\u00ed nosi\u010de dat (technika\/HW) a samotn\u00e9 po\u0159\u00edzen\u00ed forenzn\u00ed kopie dat se prov\u00e1d\u00ed v laborato\u0159i.<br \/>Zaji\u0161t\u011bn\u00ed dat p\u0159\u00edmo na m\u00edst\u011b zaji\u0161t\u011bn\u00ed se prov\u00e1d\u00ed pouze ve v\u00fdjime\u010dn\u00fdch p\u0159\u00edpadech, kdy to technologie neumo\u017e\u0148uje nebo v p\u0159\u00edpadech, kdy by vy\u0159azen\u00ed technologie z provozu zp\u016fsobilo neakceptovateln\u00e9 (z pohledu organizace) dopady. <br \/>Zaji\u0161t\u011bn\u00ed dat p\u0159\u00edmo na m\u00edst\u011b se toti\u017e vyzna\u010duje vysok\u00fdm rizikem vzniku chyby (technologick\u00e9 nebo lidsk\u00e9). <br \/>Potenci\u00e1ln\u00ed zv\u00fd\u0161en\u00e1 \u010dasov\u00e1 n\u00e1ro\u010dnost na zaji\u0161t\u011bn\u00ed techniky\/HW a n\u00e1sledn\u00e9ho zaji\u0161t\u011bn\u00ed dat v kontrolovan\u00e9m prost\u0159ed\u00ed je pouze relativn\u00ed, proto\u017ee v\u00fdrazn\u011b nejv\u00edce \u010dasu v cel\u00e9m procesu zab\u00edr\u00e1 samotn\u00e9 kop\u00edrov\u00e1n\u00ed dat a \u010das na zaji\u0161t\u011bn\u00ed techniky a jej\u00ed p\u0159evoz na kontrolovan\u00e9 pracovi\u0161t\u011b a zp\u011bt je zpravidla pouze zlomkem celkov\u00e9ho \u010dasu pot\u0159ebn\u00e9ho k forenzn\u00edmu zaji\u0161t\u011bn\u00ed (p\u0159ekop\u00edrov\u00e1n\u00ed) dat.<\/p>\n<p><strong><em>Techniku a m\u00e9dia<\/em><\/strong><\/p>\n<p>Zaji\u0161t\u011bn\u00ed techniky (HW a p\u0159\u00edpadn\u011b m\u00e9dia) na m\u00edst\u011b zaji\u0161t\u011bn\u00ed a n\u00e1sledn\u00e9 po\u0159\u00edzen\u00ed forenzn\u00edch kopi\u00ed dat v laborato\u0159i je z\u00e1kladn\u00edm kontrolovan\u00fdm zp\u016fsobem zaji\u0161t\u011bn\u00ed dat.<\/p>\n<p><strong><em>Pouze data (obrazy nebo logick\u00e9 kopie)<\/em><\/strong><\/p>\n<p>Zaji\u0161t\u011bn\u00ed pouze dat p\u0159\u00edmo na m\u00edst\u011b zaji\u0161t\u011bn\u00ed lze p\u0159edpokl\u00e1dat pouze u specifick\u00fdch p\u0159\u00edpad\u016f, kdy techniku zajistit nelze z provozn\u00edch nebo technologick\u00fdch d\u016fvod\u016f, p\u0159\u00edp. tehdy, kdy tomu br\u00e1n\u00ed procesn\u011b\u2011pr\u00e1vn\u00ed d\u016fvody (nap\u0159. ochrana osobn\u00edch \u00fadaj\u016f nebo ochrana vysoce citliv\u00fdch informac\u00ed) a existuje k tomu z\u00e1vazn\u00e9 stanovisko\/doporu\u010den\u00ed ze strany relevantn\u00edch (intern\u00edch nebo extern\u00edch) subjekt\u016f.<\/p>\n<p><strong>Vlastnictv\u00ed c\u00edlov\u00e9ho za\u0159\u00edzen\u00ed\/dat<\/strong><\/p>\n<p>Zpravidla lze zaji\u0161\u0165ovat pouze data (a techniku, na kter\u00e9 jsou takov\u00e1 data ulo\u017eena), kter\u00e1 jsou ve vlastnictv\u00ed organizace nebo ke kter\u00fdm m\u00e1 organizace opr\u00e1vn\u011bn\u00fd vztah nebo mohou p\u0159isp\u011bt k vy\u0159e\u0161en\u00ed dan\u00e9ho p\u0159\u00edpadu. <br \/>P\u0159\u00edstup k dat\u016fm (a technice), kter\u00e9 nejsou ve vlastnictv\u00ed organizace, lze zajistit pouze na z\u00e1klad\u011b form\u00e1ln\u00ed dohody s vlastn\u00edkem za\u0159\u00edzen\u00ed\/dat a po proveden\u00ed odpov\u00eddaj\u00edc\u00edch organiza\u010dn\u011b\u2011pr\u00e1vn\u00edch krok\u016f.<\/p>\n<p><strong>Z\u00e1v\u011br <br \/><\/strong>Forenzn\u00ed zaji\u0161t\u011bn\u00ed dat ve firemn\u00edm prost\u0159ed\u00ed v p\u0159\u00edpadech \u0161et\u0159en\u00ed bezpe\u010dnostn\u00edch nebo jin\u00fdch incident\u016f za \u00fa\u010delem z\u00edsk\u00e1n\u00ed d\u016fkaz\u016f m\u00e1 sv\u00e1 \u00faskal\u00ed. Na rozd\u00edl od vy\u0161et\u0159ov\u00e1n\u00ed trestn\u00e9 \u010dinnosti policii, nen\u00ed v korpor\u00e1tn\u00edm prost\u0159ed\u00ed tato \u010dinnost n\u011bjak explicitn\u011b regulov\u00e1na. T\u00edm v\u011bt\u0161\u00ed pozornost je nutn\u00e9 v\u011bnovat p\u0159\u00edprav\u011b takov\u00fdch \u00fakon\u016f. Mohou toti\u017e zasahovat do chr\u00e1n\u011bn\u00fdch z\u00e1jm\u016f subjekt\u016f, kter\u00e9 jsou s digit\u00e1ln\u00edmi d\u016fkazy spojen\u00e9. T\u00edm sp\u00ed\u0161e mus\u00ed b\u00fdt takov\u00e9 z\u00e1sahy od\u016fvodn\u011bn\u00e9, podlo\u017een\u00e9 relevantn\u00edmi pr\u00e1vn\u00edmi argumenty a proveden\u00e9 na od\u2011 pov\u00eddaj\u00edc\u00ed profesion\u00e1ln\u00ed technick\u00e9 \u00farovni. <br \/>Je proto vhodn\u00e9 p\u0159ipravit a nechat si schv\u00e1lit v r\u00e1mci organizace pl\u00e1n zaji\u0161t\u011bn\u00ed digit\u00e1ln\u00edch d\u016fkaz\u016f, kter\u00fd by m\u011bl obsahovat a popisovat n\u00e1sleduj\u00edc\u00ed okruhy ot\u00e1zek:<\/p>\n<ul>\n<li>Osobn\u00ed odpov\u011bdnost za proveden\u00ed<\/li>\n<li>D\u016fvody forenzn\u00edho zaji\u0161t\u011bn\u00ed dat<\/li>\n<li>Zv\u00e1\u017een\u00ed dopad\u016f<\/li>\n<li>Rozsah zaji\u0161t\u011bn\u00ed<\/li>\n<li>Zp\u016fsob zaji\u0161t\u011bn\u00ed<\/li>\n<li>Rychlost a \u010dasov\u00fd pl\u00e1n<\/li>\n<li>Technick\u00e9 proveden\u00ed<\/li>\n<li>Obsah zaji\u0161t\u011bn\u00ed<\/li>\n<li>Vlastnick\u00fd vztah k dat\u016fm<\/li>\n<\/ul>\n<p>Dobr\u00e1 p\u0159\u00edprava je z\u00e1rukou \u00fasp\u011b\u0161n\u00e9 akce. Nav\u00edc zajist\u00ed maximalizaci d\u016fkazn\u00e9 s\u00edly zaji\u0161t\u011bn\u00fdch digit\u00e1ln\u00edch dat a t\u00edm i \u00fasp\u011bch ve vy\u0161et\u0159ov\u00e1n\u00ed bezpe\u010dnostn\u00edch a jin\u00fdch incident\u016f ve va\u0161\u00ed organizaci.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><!-- \/divi:paragraph -->[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>","protected":false},"excerpt":{"rendered":"<p>Forenzn\u00ed zaji\u0161t\u011bn\u00ed dat ve firemn\u00edm prost\u0159ed\u00ed v p\u0159\u00edpadech \u0161et\u0159en\u00ed bezpe\u010dnostn\u00edch nebo jin\u00fdch incident\u016f za \u00fa\u010delem z\u00edsk\u00e1n\u00ed d\u016fkaz\u016f m\u00e1 sv\u00e1 \u00faskal\u00ed. Na rozd\u00edl odvy\u0161et\u0159ov\u00e1n\u00ed trestn\u00e9 \u010dinnosti polici\u00ed, nen\u00ed v korpor\u00e1tn\u00edm prost\u0159ed\u00ed tato \u010dinnost n\u011bjak explicitn\u011b regulov\u00e1na. T\u00edm v\u011bt\u0161\u00ed pozornost je nutn\u00e9 v\u011bnovat p\u0159\u00edprav\u011b takov\u00fdch\u00fakon\u016f. \u010cl\u00e1nek d\u00e1v\u00e1 n\u00e1vod na p\u0159\u00edpravu pl\u00e1nu forenzn\u00edho zaji\u0161t\u011bn\u00ed digit\u00e1ln\u00edch d\u016fkaz\u016f. \u00davod Org\u00e1ny [&hellip;]<\/p>","protected":false},"author":4,"featured_media":1713,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[6,3],"tags":[],"class_list":["post-1712","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-forenzni-analyza","category-blog"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Pl\u00e1nov\u00e1n\u00ed forenzn\u00edho zaji\u0161\u0165\u011bn\u00ed dat - n\u00e1vod na p\u0159\u00edpravu - forensee<\/title>\n<meta name=\"description\" content=\"Forenzn\u00ed zaji\u0161t\u011bn\u00ed dat ve firemn\u00edm prost\u0159ed\u00ed v p\u0159\u00edpadech \u0161et\u0159en\u00ed bezpe\u010dnostn\u00edch nebo jin\u00fdch incident\u016f za \u00fa\u010delem z\u00edsk\u00e1n\u00ed d\u016fkaz\u016f m\u00e1 sv\u00e1 \u00faskal\u00ed.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Pl\u00e1nov\u00e1n\u00ed forenzn\u00edho zaji\u0161\u0165\u011bn\u00ed dat - n\u00e1vod na p\u0159\u00edpravu - forensee\" \/>\n<meta property=\"og:description\" content=\"Forenzn\u00ed zaji\u0161t\u011bn\u00ed dat ve firemn\u00edm prost\u0159ed\u00ed v p\u0159\u00edpadech \u0161et\u0159en\u00ed bezpe\u010dnostn\u00edch nebo jin\u00fdch incident\u016f za \u00fa\u010delem z\u00edsk\u00e1n\u00ed d\u016fkaz\u016f m\u00e1 sv\u00e1 \u00faskal\u00ed.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/\" \/>\n<meta property=\"og:site_name\" content=\"forensee\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/forensee\" \/>\n<meta property=\"article:published_time\" content=\"2021-03-24T15:03:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-06-16T11:26:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.forensee.cz\/wp-content\/uploads\/2021\/03\/Vystrizek.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"429\" \/>\n\t<meta property=\"og:image:height\" content=\"240\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Mari\u00e1n Svetl\u00edk\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@forensee\" \/>\n<meta name=\"twitter:site\" content=\"@forensee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mari\u00e1n Svetl\u00edk\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/\"},\"author\":{\"name\":\"Mari\u00e1n Svetl\u00edk\",\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/person\/3c8e7324209cf97aa83d24dfe82f7b51\"},\"headline\":\"Pl\u00e1nov\u00e1n\u00ed forenzn\u00edho zaji\u0161\u0165\u011bn\u00ed dat &#8211; n\u00e1vod na p\u0159\u00edpravu\",\"datePublished\":\"2021-03-24T15:03:03+00:00\",\"dateModified\":\"2021-06-16T11:26:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/\"},\"wordCount\":4082,\"publisher\":{\"@id\":\"https:\/\/www.forensee.cz\/#organization\"},\"articleSection\":[\"Forenzn\u00ed anal\u00fdza\",\"Novinky\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/\",\"url\":\"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/\",\"name\":\"Pl\u00e1nov\u00e1n\u00ed forenzn\u00edho zaji\u0161\u0165\u011bn\u00ed dat - n\u00e1vod na p\u0159\u00edpravu - forensee\",\"isPartOf\":{\"@id\":\"https:\/\/www.forensee.cz\/#website\"},\"datePublished\":\"2021-03-24T15:03:03+00:00\",\"dateModified\":\"2021-06-16T11:26:15+00:00\",\"description\":\"Forenzn\u00ed zaji\u0161t\u011bn\u00ed dat ve firemn\u00edm prost\u0159ed\u00ed v p\u0159\u00edpadech \u0161et\u0159en\u00ed bezpe\u010dnostn\u00edch nebo jin\u00fdch incident\u016f za \u00fa\u010delem z\u00edsk\u00e1n\u00ed d\u016fkaz\u016f m\u00e1 sv\u00e1 \u00faskal\u00ed.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Dom\u016f\",\"item\":\"https:\/\/www.forensee.cz\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Pl\u00e1nov\u00e1n\u00ed forenzn\u00edho zaji\u0161\u0165\u011bn\u00ed dat &#8211; n\u00e1vod na p\u0159\u00edpravu\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.forensee.cz\/#website\",\"url\":\"https:\/\/www.forensee.cz\/\",\"name\":\"forensee\",\"description\":\"\u0158e\u0161en\u00ed a slu\u017eby v oblasti digit\u00e1ln\u00ed forenzn\u00ed anal\u00fdzy a \u0159\u00edzen\u00ed bezpe\u010dnosti informac\u00ed\",\"publisher\":{\"@id\":\"https:\/\/www.forensee.cz\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.forensee.cz\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.forensee.cz\/#organization\",\"name\":\"forensee\",\"url\":\"https:\/\/www.forensee.cz\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.forensee.cz\/wp-content\/uploads\/2020\/05\/image.png\",\"contentUrl\":\"https:\/\/www.forensee.cz\/wp-content\/uploads\/2020\/05\/image.png\",\"width\":300,\"height\":75,\"caption\":\"forensee\"},\"image\":{\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/forensee\",\"https:\/\/twitter.com\/forensee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/person\/3c8e7324209cf97aa83d24dfe82f7b51\",\"name\":\"Mari\u00e1n Svetl\u00edk\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.forensee.cz\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/a3f8efc09c00e91f6084c019b7fd5caca44443a9d90cc14b97609e20909a918b?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/a3f8efc09c00e91f6084c019b7fd5caca44443a9d90cc14b97609e20909a918b?s=96&d=mm&r=g\",\"caption\":\"Mari\u00e1n Svetl\u00edk\"},\"url\":\"https:\/\/www.forensee.cz\/en\/author\/svetlik\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Pl\u00e1nov\u00e1n\u00ed forenzn\u00edho zaji\u0161\u0165\u011bn\u00ed dat - n\u00e1vod na p\u0159\u00edpravu - forensee","description":"Forenzn\u00ed zaji\u0161t\u011bn\u00ed dat ve firemn\u00edm prost\u0159ed\u00ed v p\u0159\u00edpadech \u0161et\u0159en\u00ed bezpe\u010dnostn\u00edch nebo jin\u00fdch incident\u016f za \u00fa\u010delem z\u00edsk\u00e1n\u00ed d\u016fkaz\u016f m\u00e1 sv\u00e1 \u00faskal\u00ed.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/","og_locale":"en_US","og_type":"article","og_title":"Pl\u00e1nov\u00e1n\u00ed forenzn\u00edho zaji\u0161\u0165\u011bn\u00ed dat - n\u00e1vod na p\u0159\u00edpravu - forensee","og_description":"Forenzn\u00ed zaji\u0161t\u011bn\u00ed dat ve firemn\u00edm prost\u0159ed\u00ed v p\u0159\u00edpadech \u0161et\u0159en\u00ed bezpe\u010dnostn\u00edch nebo jin\u00fdch incident\u016f za \u00fa\u010delem z\u00edsk\u00e1n\u00ed d\u016fkaz\u016f m\u00e1 sv\u00e1 \u00faskal\u00ed.","og_url":"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/","og_site_name":"forensee","article_publisher":"https:\/\/www.facebook.com\/forensee","article_published_time":"2021-03-24T15:03:03+00:00","article_modified_time":"2021-06-16T11:26:15+00:00","og_image":[{"width":429,"height":240,"url":"https:\/\/www.forensee.cz\/wp-content\/uploads\/2021\/03\/Vystrizek.jpg","type":"image\/jpeg"}],"author":"Mari\u00e1n Svetl\u00edk","twitter_card":"summary_large_image","twitter_creator":"@forensee","twitter_site":"@forensee","twitter_misc":{"Written by":"Mari\u00e1n Svetl\u00edk"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/#article","isPartOf":{"@id":"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/"},"author":{"name":"Mari\u00e1n Svetl\u00edk","@id":"https:\/\/www.forensee.cz\/#\/schema\/person\/3c8e7324209cf97aa83d24dfe82f7b51"},"headline":"Pl\u00e1nov\u00e1n\u00ed forenzn\u00edho zaji\u0161\u0165\u011bn\u00ed dat &#8211; n\u00e1vod na p\u0159\u00edpravu","datePublished":"2021-03-24T15:03:03+00:00","dateModified":"2021-06-16T11:26:15+00:00","mainEntityOfPage":{"@id":"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/"},"wordCount":4082,"publisher":{"@id":"https:\/\/www.forensee.cz\/#organization"},"articleSection":["Forenzn\u00ed anal\u00fdza","Novinky"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/","url":"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/","name":"Pl\u00e1nov\u00e1n\u00ed forenzn\u00edho zaji\u0161\u0165\u011bn\u00ed dat - n\u00e1vod na p\u0159\u00edpravu - forensee","isPartOf":{"@id":"https:\/\/www.forensee.cz\/#website"},"datePublished":"2021-03-24T15:03:03+00:00","dateModified":"2021-06-16T11:26:15+00:00","description":"Forenzn\u00ed zaji\u0161t\u011bn\u00ed dat ve firemn\u00edm prost\u0159ed\u00ed v p\u0159\u00edpadech \u0161et\u0159en\u00ed bezpe\u010dnostn\u00edch nebo jin\u00fdch incident\u016f za \u00fa\u010delem z\u00edsk\u00e1n\u00ed d\u016fkaz\u016f m\u00e1 sv\u00e1 \u00faskal\u00ed.","breadcrumb":{"@id":"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.forensee.cz\/en\/2021\/03\/24\/planovani-forenzniho-zajisteni-dat-navod-na-pripravu\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Dom\u016f","item":"https:\/\/www.forensee.cz\/"},{"@type":"ListItem","position":2,"name":"Pl\u00e1nov\u00e1n\u00ed forenzn\u00edho zaji\u0161\u0165\u011bn\u00ed dat &#8211; n\u00e1vod na p\u0159\u00edpravu"}]},{"@type":"WebSite","@id":"https:\/\/www.forensee.cz\/#website","url":"https:\/\/www.forensee.cz\/","name":"forensee","description":"\u0158e\u0161en\u00ed a slu\u017eby v oblasti digit\u00e1ln\u00ed forenzn\u00ed anal\u00fdzy a \u0159\u00edzen\u00ed bezpe\u010dnosti informac\u00ed","publisher":{"@id":"https:\/\/www.forensee.cz\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.forensee.cz\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.forensee.cz\/#organization","name":"forensee","url":"https:\/\/www.forensee.cz\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.forensee.cz\/#\/schema\/logo\/image\/","url":"https:\/\/www.forensee.cz\/wp-content\/uploads\/2020\/05\/image.png","contentUrl":"https:\/\/www.forensee.cz\/wp-content\/uploads\/2020\/05\/image.png","width":300,"height":75,"caption":"forensee"},"image":{"@id":"https:\/\/www.forensee.cz\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/forensee","https:\/\/twitter.com\/forensee"]},{"@type":"Person","@id":"https:\/\/www.forensee.cz\/#\/schema\/person\/3c8e7324209cf97aa83d24dfe82f7b51","name":"Mari\u00e1n Svetl\u00edk","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.forensee.cz\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/a3f8efc09c00e91f6084c019b7fd5caca44443a9d90cc14b97609e20909a918b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a3f8efc09c00e91f6084c019b7fd5caca44443a9d90cc14b97609e20909a918b?s=96&d=mm&r=g","caption":"Mari\u00e1n Svetl\u00edk"},"url":"https:\/\/www.forensee.cz\/en\/author\/svetlik\/"}]}},"_links":{"self":[{"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/posts\/1712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/comments?post=1712"}],"version-history":[{"count":4,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/posts\/1712\/revisions"}],"predecessor-version":[{"id":1857,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/posts\/1712\/revisions\/1857"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/media\/1713"}],"wp:attachment":[{"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/media?parent=1712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/categories?post=1712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.forensee.cz\/en\/wp-json\/wp\/v2\/tags?post=1712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}