As someone who has performed DFIR, both as a consultant as well as an internal FTE analyst, I'd like to offer some insight. Now, I know that you're in a different country, so my perspective will be based solely on the US.
Some background...I started doing DFIR work initial late in '99, and my engagement became more prominent (moved to roles specifically involving DFIR) the following year. I've been Visa/PCI QSA certified, and conducted examinations involving data breaches, intrusions, PCI forensic assessments, as well as others that eventually involved other compliance/regulatory bodies (NCUA, HIPAA, etc.).
One of the first things I noticed in your post is that while it involved "...focus groups with experts from major consultancy firms, academia, and law enforcement", I don't see any mention of the actual targets of your survey.
In your plain language PDF, you state, "...digital forensics has become a critical function in many organizations..."; I have to ask, from whose perspective? Please understand, I'm not trying to be critical here; rather, I'm comparing this to what we see not only in the media, but in the annual reports that come out from companies such as Mandiant, TrustWave, Verizon, etc.
Again, I'm not being critical of what you're doing...rather, I'm simply commenting that the focus of your survey, and perhaps the eventual resulting analysis, seems to be directed at a group that isn't represented in your efforts to collect data.
↧