The lawyer's role in the first hours: preserve before remediating, record every action and make sure the forensic examination can provide answers later.
In the first hours of an incident, everyone works to get the systems back. That is right for the business. The problem is the order. Whoever reinstalls, restores a backup on top or changes passwords without noting it erases the answers that the insurer, the ANPD (Brazil's National Data Protection Agency) and the judge will ask for.
Evidence is lost in predictable places: cloud logs with short retention, reformatted servers, the unknown device someone took to their desk. And it is lost in the mix. When nobody records what IT did, the examination cannot separate what the attacker did from what the response did.
The lawyer does not contain the attack: that belongs to IT or the contracted provider. The lawyer decides the order and what gets recorded. The course shows how, with real cases.
Pick as many courses as you like: they are kept and arrive ticked on the registration form.
A company found on its internal network a mini computer with its own 4G modem. The examination showed that it had scanned more than a thousand machines and accessed shared folders with a network credential. The report also recorded the loss: IT had handled the device, and collecting fingerprints became impossible.
An attack hit an organisation's on-premises domain and its cloud. The examination placed the events from two domain controllers and the cloud logs on a single timeline. The on-premises domain had been compromised almost half an hour before the cloud.
A platform shared by many organisations had its server compromised, with code to capture card data. Working on a forensic copy whose integrity was verified before the examination, the expert separated the intruder, the legitimate administrators and the response team, and showed that the capture did not reach the client demanding an answer.
In groups, participants receive the scenario of an intrusion discovered on a Friday afternoon, with what IT has already done in the first two hours. In 15 minutes, they put the measures in the right order, mark what was lost and what can still be saved, and list the technical points for the notice to the insurer. The correction uses the course checklist.
Laws and rulings discussed
Law 15,040/2024, arts. 66, 68 and 134 (Brazil's Insurance Contract Act) · CD/ANPD Resolution No. 15/2024, art. 6º, § 1º (ANPD, Brazil's National Data Protection Agency) · Marco Civil da Internet, arts. 13 and 15 (Brazilian Internet Framework) · Brazilian Penal Code (CP), arts. 103, 154-A and 154-B
See also
Cloud, Identity and DevOps Forensics → Anti-Forensics and Destroyed Evidence → Forensic Services in Insurance and Cyber Claims → For Companies → See all courses →