mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-25 05:50:57 +03:00
33 lines
1.4 KiB
Markdown
33 lines
1.4 KiB
Markdown
# Standards & References
|
|
|
|
## Primary Standards
|
|
|
|
### NIST SP 800-86 - Guide to Integrating Forensic Techniques
|
|
- **Publisher**: NIST
|
|
- **Scope**: Forensic process for digital evidence collection, examination, and analysis
|
|
|
|
### ISO/IEC 27037 - Guidelines for Digital Evidence
|
|
- **Publisher**: ISO
|
|
- **Scope**: Identification, collection, acquisition, and preservation of digital evidence
|
|
|
|
### RFC 3227 - Guidelines for Evidence Collection and Archiving
|
|
- **Publisher**: IETF
|
|
- **Scope**: Best practices for evidence collection including order of volatility
|
|
|
|
## Compliance Mappings
|
|
|
|
| Framework | Requirement | Forensics Coverage |
|
|
|-----------|------------|-------------------|
|
|
| NIST 800-53 | IR-4 Incident Handling | Forensic investigation procedures |
|
|
| NIST 800-53 | AU-10 Non-repudiation | Evidence integrity via hashing |
|
|
| PCI DSS 4.0 | 12.10.5 - Incident response with forensics | Post-incident forensic analysis |
|
|
| HIPAA | 164.308(a)(6)(ii) - Response and Reporting | Forensic investigation of breaches |
|
|
|
|
## Tool References
|
|
|
|
- **Volatility 3**: https://github.com/volatilityfoundation/volatility3
|
|
- **KAPE**: https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape
|
|
- **Eric Zimmerman Tools**: https://ericzimmerman.github.io/
|
|
- **Autopsy**: https://www.autopsy.com/
|
|
- **SANS Windows Forensic Analysis Poster**: https://www.sans.org/posters/
|