The government needs to invest in digital forensics to keep pace with incidents and threats in cyberspace, the principal cyber adviser for the Department of the Air Force said Thursday.“In order to detect, help us hunt and find where the incident started… the digital forensics, I believe we need to do, and focus, and invest in that world,” said Wanda Jones-Heath, speaking at the Datadog Threat Response Forum, produced by FedScoop.The forensics role is vital even though “they’re after the fact,” she said.“They go and look what happened weeks and months after the incident has occurred, and so I think we need to figure out: ‘How do we keep pace with incidents as they are occurring?’” Jones-Heath said. “Once we identify it, then you start looking at the forensics of what happened, who did it, where they are, where it originated from and then how you partition the areas that are still under fire while you continue to operate in that environment.” Jeffrey Hunt, global operations branch chief for the Department of Defense Cyber Crime Center, which provides digital forensic investigations, said at the same event that the divide between operations and security on getting visibility into networks about threats is an issue that needs to be addressed early.But Hunt said combining the teams into one big unit is a “disaster” that doesn’t work.“It means that you at least want to have sort of a liaison relationship where somebody from security is in the room as part of the planning team from the beginning of where your operational plan starts,” he said.Another recommendation Jones-Heath made is changing how cyber exercises are conducted. The goal is not to be in “reactive mode” when an incident happens and knowing what to do with the “data is poisoned.” “They’re not designed typically of how we would operate if we have engagement,” she said. “So we have to change the lens to be more outside of the box — let the cyber team actually be engaged on the offensive and defensive side.”“We have to get over the fact that it could never happen,” she continued. “So sharing that intel about what the adversary is doing, real world, may convince those who are not in our community to let us be a part of the exercise, show them and demonstrate what the adversary is actually doing, so that if we are in formation and you get disconnected. You know exactly what to do.The post Air Force cyber official: need to invest in digital forensics appeared first on CyberScoop.