Question

Q1) what is the difference between the sender and the holder of the digital certificate? How to consider that a digital certificate is valid? How can one obtain a digital certificate for one public key without disclosing the private key? Q2) Describe the relationship between the incident response and the forensic analysis.

Answer 1

Answer 1 : The only difference between holder and sender of the digital certificate is that sender sends the digital certificate with the message to the receiver for it to decrypt the certificate using the authority's public key and then send the encrypted reply, while the holder of the certificate just holds it without sending it to anyone.

Validity of a digital certificate : A digital certificate is usually issued by CA for a period of one or two years. To check the expiry of digital certificate following steps can be performed :

1. Open Internet Explorer,

2. Click tool - > Internet Options

3 . Content ---> Certificate

4 . You will get the validity of the certificate

For getting digital certificate for public key following process can be followed :

The sender or key holder can generate key pair locally and then apply to the CA for a certificate, submitting only the public key data. This way you can protect your private key and CA will issue the digital certificate basis on the public key which is sent with the data to the receiver.

Answer 2 :

Incident response and forensic analysis are similar principles that can use similar tools and related data sets. Though being quite similar , there are also some important differences between the two. The two can be distinguished on the following factors :

1. Goals :   Incident response is usually focused on finding a quick solution or reaction to an immediate threat or issue, but forensic analysis is usually performed as a part of a scheduled compliance, or legal discovery, or an investigation.

2. Data requirements : Incident response usually only require short-term data sources, while forensic analysis teams require much longer lived data and files.

3. Team skill : Although there is a lot of similarity in the team or personnel skills required for incident response and forensic analysis teams , but there are also some important skills differences. Incident response involves interacting with security and operations team members. Forensic analysis involves interacting with a lot more departments, including operations, legal, compliance and HR teams/departments.