In order to be able to successfully prosecute an intruder:
A.
A point of contact should be designated to be responsible for communicating with law
enforcement and other external agencies.
B.
A proper chain of custody of evidence has to be preserved
C.
Collection of evidence has to be done following predefined procedures
D.
Whenever possible, analyze, a replica of the compromised resource, not the original, thereby
avoiding inadvertently tampering with evidence