Experts May Decide if You Are a Hero or Will Wear Orange
summary
Panel explains how expert testimony hinges on concrete methods not buzzwords: who qualifies, what logs and artifacts are preserved, and whether dark‑web matches are validated. Expect emphasis on document facts not opinions, on preserving forensic state and chain of custody, on using a defensible repeatable process for data-matching and class ascertainment, and on the practical tradeoff between early counsel to preserve privilege versus immediate technical containment.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 6:26Why experts matter
- 13:55Incident containment pitfalls
- 23:53Documentation and privilege
- 33:38Class ascertainment challenges
- 42:14Credible expert witness
- 47:13Repeatable incident protocols
- 49:42Privilege versus response
- 51:28Closing and Q&A
related talks
44mPresenting Technical Evidence in Court
01h 20mBeyond the Encryption Debate
52mUnderstanding the Role of Cybersecurity Expert Witnesses
49mIR: Optimizing Communications and Action Between Legal and Tech Leaders
01h 00mHow 2020 Vision Has Blurred Attorney Client Privilege in Incident Response
31mDiamonds are a Forensicator's Best Friend - Intelligence Support for DFIR
28mWho Did It? Getting Started with Threat Actor Profiling
48mOnline Hate — Evidence and Traces That Make Identifying the Perpetrator Easier