Certified: The GIAC GLEG Audio Course

Every digital investigation provides a wealth of information that should be used to improve the organization's future defensive and investigative capabilities. This episode explains how to conduct a "Post-Incident Review" and translate technical findings into actionable playbooks for the security operations center. For certification, it is important to know how to identify the "root cause" of an i...

When an organization decides to pursue criminal charges for a cybercrime, the quality of the law-enforcement referral determines whether the authorities will take the case. This episode explores what a "prosecutable" referral looks like, including a clear description of the harm, the identified evidence, and a summary of the loss incurred. For the GLEG exam, understanding the "jurisdictional" boun...

Knowing when and how to escalate a security incident is a strategic skill that requires a balance of technical urgency and legal caution. This episode examines the internal "escalation paths" and the criteria used to determine if a minor anomaly has crossed the threshold into a full-scale legal or regulatory event. For certification purposes, candidates must understand the notification requirement...

An investigation report is the primary bridge between technical forensic findings and the non-technical stakeholders who must make decisions based on those facts. This episode details how to structure a report that includes an executive summary, a detailed methodology, and clear, evidence-backed conclusions. For the GLEG exam, practitioners must learn how to present "opinion" versus "fact" and ens...

The integrity of an entire investigation rests on the initial preservation of digital evidence using standardized, forensically sound methods. This episode covers the technical requirements for bit-stream imaging, write-blocking, and the immediate verification of data using cryptographic hashing. For certification, candidates must understand how to avoid the "footprints" that accidental boot-ups o...

Successful digital investigations rely on the seamless coordination between technical forensic experts and legal counsel to ensure all findings are protected and strategically sound. This episode explores the "triad" of incident response, where the technologist provides the ground truth, the attorney manages the legal risk, and the organization maintains business continuity. For the GLEG exam, it...

Proactive identification of fraud and internal misuse is the most effective way to minimize the financial and reputational impact of a security incident. This episode examines common patterns of digital fraud, such as insider trading, intellectual property theft, and financial statement manipulation. For certification purposes, candidates must understand how to utilize "detective controls"—such as...

Understanding the statutory landscape of computer crime is a mandatory requirement for any professional involved in incident response or digital investigations. This episode surveys major laws such as the Computer Fraud and Abuse Act (CFAA) and the Wiretap Act, explaining how they define "unauthorized access" and "interception." For the GLEG exam, it is vital to know the difference between civil a...

This rapid-fire recap episode consolidates the most critical takeaways from the records retention and e-discovery domains to ensure a high level of recall for the GLEG exam. We revisit the core stages of the EDRM, the legal "triggers" for a litigation hold, and the technical requirements for a forensically sound collection. For the certification, candidates should be comfortable distinguishing bet...

Disposing of data that has reached the end of its retention period is a vital but risky task that must be performed with total administrative and technical precision. This episode explores how to execute "defensible disposition" by ensuring that no data is deleted while it is subject to a litigation hold or a regulatory inquiry. For certification purposes, it is important to understand the differe...

Regularly auditing your records retention controls is the only way to ensure that your governance policies are being translated into actual practice. This episode details the process of verifying that data is being deleted or archived according to the formal schedule across all business units and technical platforms. For the GLEG exam, candidates must know how to evaluate "compliance artifacts"—su...

The rules governing e-discovery are constantly evolving through landmark judicial decisions that set the standard for "reasonable" behavior in the digital age. This episode reviews influential cases, such as Zubulake v. UBS Warburg, which established the primary framework for cost-shifting and the duty to preserve electronic records. For the GLEG exam, understanding these precedents is essential f...

The collection phase of e-discovery requires a surgical approach to gather relevant data without over-collecting unnecessary or privileged information. This episode explores the technical workflows used to extract Electronically Stored Information (ESI) from various sources, including cloud storage, mobile devices, and legacy servers. For certification, it is critical to understand the principle o...

Maintaining the integrity of electronic evidence is paramount for its admissibility in a court of law. This episode focuses on the "chain of custody," which provides a documented, chronological history of the evidence from the moment of collection to its presentation in court. For the GLEG exam, practitioners must understand the importance of cryptographic hashing to prove that an electronic file...

The issuance of a litigation hold is a high-stakes event that requires immediate and precise action to halt the routine destruction of potentially relevant evidence. This episode examines the "duty to preserve" and the technical steps necessary to ensure that data remains intact once a legal dispute is reasonably anticipated. For certification purposes, it is essential to know how to identify rele...

A robust records retention schedule is a critical component of information governance, balancing business needs with legal and regulatory requirements. This episode explores how to determine the "life cycle" of various data types, from creation to final disposition, ensuring that information is neither deleted prematurely nor kept indefinitely. For the GLEG exam, candidates must understand that re...

Electronic discovery, or e-discovery, is the process by which organizations must identify, preserve, and produce digital evidence in response to a legal or regulatory request. This episode introduces the Electronic Discovery Reference Model (EDRM) and the various stages of the litigation lifecycle. For the GLEG exam, understanding the "duty to preserve" and when the "litigation trigger" is pulled...

The GLEG exam is dense with specialized acronyms that can trip up even the most experienced professionals if they are not second nature. This episode provides a rapid-fire audio glossary of the most common terms you will encounter, such as ESI (Electronically Stored Information), FRCP (Federal Rules of Civil Procedure), and DMCA (Digital Millennium Copyright Act). For certification, it is vital to...

Electronic signatures have become the standard for modern business, but they must meet specific technical and legal criteria to be considered as valid as a physical "ink" signature. This episode explores the different levels of electronic signatures, from simple checked boxes to cryptographically secure digital signatures. For the GLEG exam, understanding the ESIGN Act and the UETA, and how they p...

The method by which an organization obtains agreement from its users online determines the legal enforceability of its terms and policies. This episode compares the legal strength of "clickwrap" agreements, which require a deliberate action, versus "browsewrap" agreements, which rely on the mere use of the site. For the GLEG exam, candidates must be familiar with the "conspicuousness" and "reasona...

To truly protect the organization, service level agreements (SLAs) must be bolstered with specific, enforceable security and audit requirements. This episode outlines how to draft clauses that define "up-time" in a security context and establish the right to perform independent security assessments of the vendor’s environment. For certification, it is critical to understand the role of SOC 2 repor...

Sharing personal data between corporate affiliates or subsidiaries requires a sophisticated governance framework to avoid significant privacy and regulatory violations. This episode examines the legal requirements for "inter-company" data transfer agreements and the necessity of maintaining transparency with the data subjects. For the GLEG exam, practitioners must understand the concept of "joint...

When engaging independent contractors or consultants, the protection of intellectual property and the clear definition of liability are paramount. This episode details the process of vetting contractor agreements to ensure that "Work for Hire" clauses are properly structured so the organization retains ownership of all created assets. For the GLEG exam, candidates must understand the difference be...

Navigating the complex and often dense language of Terms of Service (ToS) is a vital skill for preventing accidental legal or technical liabilities. This episode focuses on how to triage these agreements to identify "unconscionable" terms, hidden data sharing permissions, and broad liability waivers that could harm the organization. For certification purposes, it is important to understand the leg...

Managing third-party risk begins with the inclusion of robust security and privacy clauses within every vendor and partner contract. This episode explores the essential legal components of a secure agreement, such as right-to-audit clauses, breach notification requirements, and data return or destruction mandates. For the GLEG exam, understanding the "privity of contract" and how liability can be...