a) Is it easier to punish employees or to prosecute outside attackers?
b) Why do companies often not prosecute attackers?
c) What is forensics evidence? Contrast what cybercrimes the FBI and local police investigate.
d) Why should both be called?
e) Under what conditions will you need to hire a forensics expert?
f) Why should you hire a forensics expert rather than doing your own investigation?
g) What is the chain of evidence, and why is documenting it important?