Unit 1: SOC Fundamentals and Incident Response

1. Introduction to the Security Operations Center (SOC)

1.1 Definition, Mission, and Strategic Objective

A Security Operations Center (SOC) is a centralized, organized, and dedicated organizational function staffed by skilled cybersecurity personnel, governed by formalized processes, and powered by specialized technologies. The mission of a SOC is to continuously monitor, detect, analyze, triage, investigate, and respond to cybersecurity threats, anomalies, and active intrusions across an enterprise's information technology (IT), operational technology (OT), and cloud environments.

CODECopy Code
+-----------------------------------------------------------------------------------+
|                        SECURITY OPERATIONS CENTER (SOC) TAXONOMY                  |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|         +-----------------------+                   +-----------------------+     |
|         |     CORE MISSION      |                   |    PRIMARY OBJECTIVE  |     |
|         +-----------------------+                   +-----------------------+     |
|         | Continuous Monitoring |                   | Reduce MTTD & MTTR    |     |
|         | 24/7/365 Visibility   |                   | Minimize Blast Radius |     |
|         | Multi-source Telemetry|                   | Business Continuity   |     |
|         | Incident Containment  |                   | Regulatory Compliance |     |
|         +-----------------------+                   +-----------------------+     |
|                     |                                           |                 |
|                     +---------------------+---------------------+                 |
|                                           |                                       |
|                               +-----------------------+                           |
|                               | THE PEOPLE-PROCESS-   |                           |
|                               | TECHNOLOGY TRIAD      |                           |
|                               +-----------------------+                           |
|                               | People: Tier 1-4, Sec |                           |
|                               | Process: SOPs, SANS   |                           |
|                               | Tech: SIEM, SOAR, EDR |                           |
|                               +-----------------------+                           |
+-----------------------------------------------------------------------------------+

Core Strategic Metrics

The efficacy of a modern SOC is quantified through rigorous operational key performance indicators (KPIs):

1. Mean Time to Detect (MTTD):
   $\text{MTTD} = \frac{1}{N} \sum_{i=1}^N \left( t_{\text{detected}, i} - t_{\text{compromise}, i} \right)$
   Measures the average elapsed duration from an adversary's initial foothold or compromise event until the incident is identified by security monitoring systems.
2. Mean Time to Respond / Acknowledge (MTTA):
   $\text{MTTA} = \frac{1}{N} \sum_{i=1}^N \left( t_{\text{acknowledged}, i} - t_{\text{alert}, i} \right)$
   Quantifies analyst responsiveness to incoming high-fidelity security alerts.
3. Mean Time to Remediate / Contain (MTTR):
   $\text{MTTR} = \frac{1}{N} \sum_{i=1}^N \left( t_{\text{contained}, i} - t_{\text{detected}, i} \right)$
   Measures the average duration required by incident responders to neutralize the threat, sever lateral movement, and eradicate adversary access from the environment.
4. Dwell Time: The total window of time an adversary operates undetected within an enterprise network prior to eviction:
   $\text{Dwell Time} = t_{\text{eviction}} - t_{\text{initial access}} = \text{MTTD} + \text{MTTR}$

1.2 Enterprise Importance and Value Proposition

1. Continuous 24/7/365 Situational Awareness: Adversaries operate across global time zones, often launching automated ransomware payloads during holidays or off-peak hours. A dedicated SOC ensures unremitting defensive posture.
2. Minimizing Breach Blast Radius: Early detection confines threat actors to the initial point of entry, preventing lateral movement, privilege escalation, and mass data exfiltration.
3. Regulatory and Legal Compliance: Mandatory frameworks across sectors—such as PCI DSS (Requirement 10: Log Monitoring), HIPAA (§164.308 Security Management), GDPR (Article 33: 72-hour breach disclosure), ISO/IEC 27001 (Control A.12.4 Logging and Monitoring), and NIST Cybersecurity Framework (CSF)—strictly mandate centralized security monitoring and auditable incident response workflows.
4. Intellectual Property and Brand Preservation: Preventing public breach disclosures safeguards customer trust, protects shareholder value, and circumvents punitive regulatory fines.

1.3 Major Operational Challenges Faced by Modern SOCs

CODECopy Code
CHALLENGES IN MODERN SECURITY OPERATIONS:
- ALERT FATIGUE: Millions of raw logs/day -> Thousands of alerts -> Analyst burnout
- VISIBILITY BLIND SPOTS: Encrypted traffic (TLS 1.3), unmanaged IoT, rogue shadow cloud assets
- SKILLS DEFICIT: Severe global shortage of certified Tier 2/3 incident responders
- SOPHISTICATED ADVERSARIES: Living-off-the-Land (LotL), polymorphic malware, supply chain attacks

1. Alert Fatigue and High False-Positive Ratios: SOCs ingest gigabytes to terabytes of event logs daily. Poorly tuned detection rules flood analyst queues with thousands of low-fidelity alerts, desensitizing staff and causing critical security alarms to be missed.
2. Expanding Attack Surface & Visibility Blind Spots: Proliferation of hybrid cloud architectures (AWS, Azure, GCP), remote work endpoints, unmanaged bring-your-own-device (BYOD) hardware, and end-to-end encryption (TLS 1.3 / DoH) obscure network inspection.
3. Severe Cybersecurity Talent Deficit: The cybersecurity industry faces a multi-million-person workforce shortage. Retaining specialized talent against high-stress 24/7 rotational shifts represents an ongoing institutional vulnerability.
4. Adversary Asymmetry and Living-off-the-Land (LotL) Tactics: Threat actors increasingly bypass signature-based endpoint antivirus by leveraging native legitimate administrative binaries (PowerShell.exe, WMI, rundll32.exe, certutil.exe), rendering detection dependent on complex behavioral analytics.

1.4 SOC Organizational and Operational Models

1.5 Tiered Roles and Responsibilities in a SOC

CODECopy Code
TIERED SOC OPERATIONAL HIERARCHY:
                  +-----------------------------------+
                  |  TIER 4: SOC Manager & Leadership  |
                  |  Strategy, Governance, Metrics    |
                  +-----------------------------------+
                                    |
                  +-----------------------------------+
                  |  TIER 3: Threat Hunter / SME       |
                  |  Proactive Hunting, Malware RE    |
                  +-----------------------------------+
                                    | Escalation
                  +-----------------------------------+
                  |  TIER 2: Incident Responder       |
                  |  Root Cause, Containment, Erad.   |
                  +-----------------------------------+
                                    | Escalation
                  +-----------------------------------+
                  |  TIER 1: Triage Analyst           |
                  |  Alert Validation, False Positives|
                  +-----------------------------------+
                                    ^
                               Telemetry Ingestion

Tier 1: Triage Analyst (Alert Analyst)

• Primary Function: First line of defense monitoring SIEM queues 24/7/365.
• Key Responsibilities:
  • Review incoming security events, alerts, and anomaly triggers.
  • Distinguish genuine security events from benign false positives using pre-defined Standard Operating Procedures (SOPs).
  • Enrich alert telemetry with contextual data (IP reputation, user role, asset criticality).
  • Escalate verified, high-risk security incidents to Tier 2 with structured triage notes.

Tier 2: Incident Responder (Security Analyst)

• Primary Function: In-depth incident investigation, threat containment, and eradication.
• Key Responsibilities:
  • Reconstruct adversary attack timelines across multiple correlated log sources.
  • Perform live response on compromised endpoints (memory dumps, process analysis, persistence checks).
  • Execute active containment measures (network host isolation, revoking Kerberos tokens, blocking malicious C2 domains at perimeter firewalls).
  • Determine root-cause compromise vectors and draft comprehensive technical incident reports.

Tier 3: Threat Hunter / Advanced Forensic Specialist

• Primary Function: Proactive, hypothesis-driven threat discovery and advanced tradecraft analysis.
• Key Responsibilities:
  • Search for latent adversaries operating undetected beneath alert thresholds.
  • Conduct reverse engineering of obfuscated scripts and compiled malware binaries.
  • Map adversary behaviors to standardized frameworks (MITRE ATT&CK).
  • Advise detection engineers on developing custom detection rules (YARA, Sigma, Snort/Suricata).

Tier 4: SOC Manager / Director

• Primary Function: Operational leadership, governance, capacity planning, and stakeholder communication.
• Key Responsibilities:
  • Oversee budgeting, procurement, and integration of security technologies.
  • Track and report SOC KPIs (MTTD, MTTR, false positive ratios) to the CISO and executive board.
  • Formulate incident response escalation matrices and business continuity playbooks.
  • Manage staffing, professional development, and shift rotation schedules.

2. The Pillars of an Effective SOC

2.1 The People, Process, and Technology (PPT) Framework

Operational success requires a balanced alignment across three structural pillars:

CODECopy Code
THE PEOPLE-PROCESS-TECHNOLOGY EQUILIBRIUM:
                     [ PEOPLE ]
                    /          \
                   /   EFFECTIVE\
                  /      S O C   \
                 /                \
        [ PROCESS ] ------------ [ TECHNOLOGY ]

1. People: The human cognitive element responsible for contextual intuition, critical analysis, and strategic decision-making. Without skilled analysts, advanced tools produce unread noise.
2. Process: Formalized, repeatable, and auditable methodologies that standardize operations. Without structured processes, incident handling descends into chaotic ad-hoc reactions.
3. Technology: The automated infrastructure providing continuous visibility, data aggregation, real-time analytics, and rapid containment execution.

2.2 The SOC Technology Stack Architecture

CODECopy Code
+-----------------------------------------------------------------------------------+
|                            THE SOC TECHNOLOGY STACK                               |
+-----------------------------------------------------------------------------------+
|  1. SIEM (Security Information and Event Management):                             |
|     Log ingestion, normalization (CEF/JSON), correlation rules, retention.       |
|                                                                                   |
|  2. SOAR (Security Orchestration, Automation, and Response):                      |
|     Playbook execution, API workflow orchestration, automated containment.       |
|                                                                                   |
|  3. EDR / XDR (Endpoint / Extended Detection and Response):                       |
|     Kernel-level telemetry, process lineage, behavioral heuristics, isolation.    |
|                                                                                   |
|  4. NDR (Network Detection and Response):                                         |
|     Deep packet inspection (DPI), NetFlow/IPFIX, protocol anomaly detection.     |
|                                                                                   |
|  5. TIP (Threat Intelligence Platform):                                           |
|     Aggregates STIX/TAXII feeds, IOC enrichment, adversary tracking.             |
+-----------------------------------------------------------------------------------+

Detailed Technology Breakdown

1. SIEM (Security Information and Event Management):
   • Ingests diverse event streams: Windows Event Logs (Security, Sysmon), Linux Syslog, firewall state tables, authentication servers (Active Directory, Okta), and cloud audit trails (AWS CloudTrail).
   • Normalizes unstructured text into common schemas (e.g., Elastic Common Schema - ECS, Splunk CIM).
   • Evaluates multi-event correlation rules in real time (e.g., “Alert if >5 failed logins occur within 60 seconds followed by 1 successful login and immediate execution of vssadmin.exe delete shadows”).
2. SOAR (Security Orchestration, Automation, and Response):
   • Integrates disparate security tools via bidirectional REST APIs.
   • Executes automated response playbooks (e.g., querying VirusTotal for file hashes, disabling compromised user accounts in Active Directory, isolating hosts via EDR APIs) in seconds rather than hours.
3. EDR / XDR (Endpoint / Extended Detection and Response):
   • Deploys endpoint agents to monitor operating system internals (process creations, DLL injections, registry modifications, socket connections).
   • Maintains historical process trees (parent-child relationships) enabling rapid timeline reconstruction.
4. Threat Intelligence Platforms (TIP):
   • Consolidates open-source (OSINT), commercial, and government threat feeds.
   • Cross-references incoming telemetry against known malicious IP addresses, domain names, file hashes, and adversary infrastructure.

2.3 Process Frameworks: SOPs, Playbooks, and Runbooks

• Standard Operating Procedure (SOP): High-level documentation establishing organizational policies, role assignments, shift handover requirements, and regulatory compliance constraints.
• Playbook: A comprehensive, process-oriented workflow guiding analysts through the end-to-end lifecycle of a specific incident type (e.g., Phishing Playbook, Ransomware Playbook, DDoS Playbook).
• Runbook: Highly detailed, command-by-command instructions outlining specific technical actions (e.g., “How to execute volatile memory acquisition on a Windows Server 2022 domain controller using WinPmem”).

3. Security Incident Response Lifecycle

3.1 Formal Incident Taxonomy and Definitions

• Event: Any observable occurrence in an information system or network (e.g., a user logging in, a firewall packet drop, a DNS query).
• Security Event: An observable occurrence that has security relevance or impacts system state (e.g., a port scan, a failed privilege escalation attempt).
• Adverse Event: An event with a negative consequence, such as a denial-of-service condition or unauthorized access attempt.
• Incident / Security Incident: An adverse event or violation (or imminent threat of violation) of computer security policies, acceptable use policies, or standard security practices (NIST SP 800-61 Rev. 2).

3.2 The NIST SP 800-61 Rev. 2 Incident Response Framework

The National Institute of Standards and Technology (NIST) outlines a continuous four-phase incident handling cycle:

CODECopy Code
NIST SP 800-61 REV. 2 INCIDENT RESPONSE LIFECYCLE:

             +---------------------------------------+
             |             1. PREPARATION            |
             +---------------------------------------+
                                 |
                                 v
             +---------------------------------------+
      +----> |       2. DETECTION & ANALYSIS         | <----+
      |      +---------------------------------------+      |
      |                          |                          |
      |                          v                          |
      |      +---------------------------------------+      |
      +----- |  3. CONTAINMENT, ERADICATION & RECOVERY| -----+
             +---------------------------------------+
                                 |
                                 v
             +---------------------------------------+
             |      4. POST-INCIDENT ACTIVITY        |
             |           (Lessons Learned)           |
             +---------------------------------------+

Phase 1: Preparation

• Establishing enterprise incident response policies and appointing the Computer Security Incident Response Team (CSIRT).
• Hardening underlying infrastructure (patching vulnerabilities, implementing least-privilege access, configuring centralized logging).
• Procuring and pre-installing incident response toolkits ("jump bags", forensic acquisition software, out-of-band communication channels).
• Conducting table-top exercises (TTX) and adversary simulation drills.

Phase 2: Detection and Analysis

• Ingesting, correlating, and evaluating alert telemetry.
• Triage and Scope Assessment: Determining attack breadth (which systems, user accounts, and data assets are impacted).
• Severity Classification and Prioritization: Categorizing incidents based on business impact, system criticality, and data sensitivity.

CODECopy Code
SEVERITY MATRIX SCORING:
+-----------------------+-----------------------------------------------------------+
| Severity Level        | Operational Criteria & Escalation Response               |
+-----------------------+-----------------------------------------------------------+
| P1: Critical / Catast.| Enterprise-wide ransomware, active exfiltration of PII,   |
|                       | domain controller compromise. Mandatory CISO/CEO briefing.|
| P2: High              | Root-level compromise of single non-critical server,     |
|                       | lateral movement detected. Tier 2/3 active response.      |
| P3: Medium            | Single workstation malware infection, isolated phishing   |
|                       | click without execution. Tier 1/2 standard handling.      |
| P4: Low / Informational| Port scanning, blocked web exploit, benign adware.       |
|                       | Automated ticketing / Tier 1 review.                      |
+-----------------------+-----------------------------------------------------------+

Phase 3: Containment, Eradication, and Recovery

• Short-Term Containment: Immediate tactical actions designed to limit the blast radius without destroying volatile forensic evidence (e.g., isolating an infected endpoint from the network via EDR, modifying perimeter firewall access control lists).
• Long-Term Containment: Implementing temporary workarounds to maintain operational continuity while major systems undergo investigation (e.g., setting up clean alternate network segments, forcing enterprise-wide credential resets).
• Eradication: Completely eliminating all remnants of the threat from the environment:
  • Terminating malicious processes.
  • Deleting malware binaries, dropped scripts, and temporary staging directories.
  • Removing persistence mechanisms (scheduled tasks, registry Run keys, WMI event subscriptions, cron jobs, rogue administrative accounts).
  • Remedying the root-cause vulnerability (applying vendor security patches, closing exposed RDP ports).
• Recovery: Restoring affected systems to normal production operations:
  • Restoring files from clean, offline, verified backups.
  • Rebuilding operating systems from trusted golden images.
  • Reconnecting systems to the network with enhanced telemetry logging.
  • Conducting validation testing to confirm systems function securely without reinfection.

Phase 4: Post-Incident Activity (Lessons Learned)

• Conducting a formal Lessons Learned Meeting within 1 to 2 weeks post-resolution.
• Root Cause Analysis (RCA): Pinpointing exact technical, architectural, or human failures that permitted the intrusion.
• Incident Timeline Reconstruction: Documenting an exact, chronological record of adversary activity.
• Updating incident response playbooks, detection rules, and employee training to prevent recurrence.
• Archiving digital forensic evidence in accordance with statutory retention mandates.

3.3 The SANS Institute 6-Step Incident Handling Process

The SANS Institute formalizes a closely aligned 6-phase framework:

CODECopy Code
SANS 6-STEP INCIDENT HANDLING PROCESS:
[ 1. Preparation ] ---> [ 2. Identification ] ---> [ 3. Containment ]
                                                            |
[ 6. Lessons Learned ] <-- [ 5. Recovery ] <--- [ 4. Eradication ]

1. Preparation: Formulate policies, assign roles, deploy security monitoring tooling.
2. Identification: Detect anomalous behavior, verify security alerts, establish incident scope.
3. Containment: Limit the blast radius; isolate affected assets while preserving evidence.
4. Eradication: Remove malicious artifacts, patch underlying vulnerabilities, evict adversary footholds.
5. Recovery: Restore operations from trusted media, reintroduce systems into production, monitor closely.
6. Lessons Learned: Comprehensive post-mortem review, documentation, updating defenses.

4. Threat Modeling, Adversary Frameworks, and Intelligence

4.1 Threat Modeling Frameworks Comparison

CODECopy Code
+-----------------------------------------------------------------------------------+
|                        CYBER DEFENSIVE FRAMEWORKS COMPARISON                      |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  1. LOCKHEED MARTIN CYBER KILL CHAIN:                                             |
|     Linear, perimeter-focused model of attack progression:                        |
|     Recon -> Weaponize -> Deliver -> Exploit -> Install -> C2 -> Actions on Obj.  |
|                                                                                   |
|  2. MITRE ATT&CK FRAMEWORK:                                                       |
|     Matrix of real-world adversary Tactics, Techniques, and Procedures (TTPs).    |
|     Tactics (Why/Objective) vs. Techniques (How) vs. Procedures (Specific Impl.). |
|                                                                                   |
|  3. THE DIAMOND MODEL OF INTRUSION ANALYSIS:                                      |
|     Relational model linking four core components:                                |
|     Adversary <-----> Infrastructure <-----> Capability <-----> Victim            |
+-----------------------------------------------------------------------------------+

1. The Cyber Kill Chain (Lockheed Martin)

Models external attacks as a sequential, seven-stage linear progression:

1. Reconnaissance: Researching targets (harvesting email addresses, scanning IP ranges).
2. Weaponization: Pairing an exploit with a malicious payload (e.g., malicious macro in .docx).
3. Delivery: Transmitting the weaponized payload (phishing email, USB drop, watering hole).
4. Exploitation: Triggering exploit code to execute malicious instructions on the host.
5. Installation: Establishing persistence on the compromised asset (registry keys, web shells).
6. Command and Control (C2): Opening an encrypted communications channel back to adversary infrastructure.
7. Actions on Objectives: Achieving final goals (data theft, ransomware encryption, destruction).

Defensive Principle: Disrupting the adversary at any single link breaks the kill chain and defeats the attack.

2. The MITRE ATT&CK Framework

Unlike the linear Kill Chain, MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a dynamic, non-linear knowledge base reflecting empirical adversary behaviors:

• Tactics: The adversary's technical objective (the “why”): Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.
• Techniques: The specific mechanism employed to achieve an objective (the “how”): e.g., T1059 (Command and Scripting Interpreter).
• Procedures: The exact execution implementation by a specific threat group (e.g., APT29 executing PowerShell with Base64-encoded strings).

3. The Diamond Model of Intrusion Analysis (Sergio et al., 2013)

Represents every malicious event as a diamond structure connecting four core nodes:

• Adversary: The actor responsible for the intrusion (threat group, nation-state, cybercriminal).
• Capability: The tools, malware, exploits, and technical tradecraft employed.
• Infrastructure: The physical or virtual architectures used to deliver capabilities (C2 IP addresses, domains, botnets).
• Victim: The target organization, person, network asset, or email address.

5. Forensic Handling, Evidence Integrity, and Chain of Custody

5.1 Order of Volatility (RFC 3227)

During security incident handling, volatile digital evidence must be captured in order of increasing permanence to prevent critical in-memory artifacts from being overwritten:

CODECopy Code
ORDER OF VOLATILITY (RFC 3227) - FROM MOST TO LEAST VOLATILE:
  1. CPU Registers and Cache Contents
  2. Routing Tables, ARP Cache, Process Tables, Kernel Memory
  3. Physical RAM (System Volatile Memory)
  4. Temporary File Systems, Swap Space, Virtual Memory
  5. Non-Volatile Disk Storage (Local SSDs, HDDs, File Allocation Tables)
  6. Remote Logging Data and Network Topologies
  7. Physical Configuration and Network Cabling
  8. Archival Backup Media (Tapes, Optical Media)

Forensic Rule: Pulling the physical power plug immediately destroys categories 1 through 4 (including injected malware DLLs, unencrypted memory credentials, active network sockets, and temporary process structures). Live triage or memory dumping must precede system shutdown.

5.2 Chain of Custody and Evidence Integrity

For digital evidence to remain admissible in legal proceedings, strict Chain of Custody protocols must be enforced:

1. Cryptographic Hashing: Immediately upon acquiring an evidence image, generate cryptographic checksums using collision-resistant algorithms (SHA-256). Record the hash in evidence logs. Any subsequent alteration of even a single bit alters the hash, invalidating evidence integrity.
2. Hardware Write-Blockers: Connect suspect physical media through hardware write-blocking bridges that intercept and block OS write commands (Write, Delete, Format), guaranteeing physical evidence remains unmodified.
3. Custodial Log Documentation: Maintain an unbroken, signed record detailing:
   • Who collected the evidence.
   • Exact timestamp of collection.
   • Secure storage location.
   • Name and reason of every individual accessing or transferring the evidence.

6. Information Sharing, Threat Intelligence, and Communication Protocols

6.1 Standardized Threat Intelligence Formats

CODECopy Code
THREAT INTELLIGENCE STANDARDIZATION ARCHITECTURE:
+-----------------------------------------------------------------------------------+
|  STIX (Structured Threat Information eXpression):                                 |
|  JSON-based structured language modeling threats:                                 |
|  Adversary -> Uses Tool -> Exploits Vulnerability -> Targets Identity (JSON graph)|
|                                                                                   |
|  TAXII (Trusted Automated eXchange of Intelligence Information):                  |
|  Application layer HTTPS REST protocol for transport and exchange of STIX models |
|  Supports Channels (Publish/Subscribe) and Collections (Request/Response)         |
+-----------------------------------------------------------------------------------+

• STIX: A structured graph specification using JSON to describe threat actors, campaigns, TTPs, attack patterns, indicators, observables, and mitigations.
• TAXII: An HTTPS protocol designed specifically for securely exchanging STIX-formatted threat intelligence across organizations in real time.
• MISP (Open Source Threat Intelligence Platform): A trusted collaborative system used by CSIRTs and ISACs (Information Sharing and Analysis Centers) to share IOCs and threat actors.

6.2 Crisis Communication and Escalation Protocols

1. Technical Escalation: Standardized notification path from Tier 1 analyst through Tier 2/3 responders to the SOC Manager based on severity thresholds.
2. Executive and Legal Briefings: Non-technical, risk-oriented briefings delivered to the CISO, Chief Legal Counsel, and Board of Directors, articulating operational impact, potential data exposure, and financial exposure.
3. Statutory Regulatory Notifications: Strict compliance with mandatory regulatory reporting windows:
   • GDPR: Supervisory authority notification within 72 hours of becoming aware of a personal data breach.
   • SEC (Cybersecurity Disclosure Rule): Public disclosure of material cybersecurity incidents on Form 8-K within 4 business days.
   • CERT-In (India): Mandatory reporting of specified cyber incidents within 6 hours of notice.
4. Law Enforcement Coordination: Engaging relevant investigative agencies (FBI Cyber Division, CISA, Interpol) while preserving digital chain of custody.

7. Comparative Operational Matrix