I am trying to consolidate a list of security tools for our data center servers. We are predominantly Linux shop (RHEL) with some Windows 2008/12 servers. The core business is Software as a Service, so it is not a classical corporate environment. Also, we are using NIST 800-53 standard and based on the requirements, implementation of forensics tools is implied. From your best practices, would you deploy hard drive forensics tool such as EnCase or FTK in a server farm?
Unless you are going to use the tool's agents during an investigation, I would keep the forensic tools off of production servers. Generally these tools are intended to be run in a client environment, such as on an investigator's laptop or desktop.
There are a few reasons for this suggestion:
- persistence of forensic tools in a server environment can make further compromise easier
- aside from memory collection, forensics should be done on an image, and so they would done outside of a live server environment
- it is easier to collect and lock up client laptops or desktops for legal proceedings than it is a server farm with the forensic tools
The exception to this is case management software. There may be a want or need to have server-side case management software that investigators use during the life of an incident. This is not uncommon in enterprise environments. However, I separate this from the actual forensic software such as the EnCase and FTK packages that you mentioned. The case management should be where investigators comment on the incident, share details, but the image collection and management should be done in the contained client environment.