Forensic Control

Forensic Control


Forensic Control is an insider threat management consultancy. We protect our clients through the delivery of
evidence-based cyber and behavioural forensic analysis. Our mission is to prevent, detect and investigate the
harmful actions of malevolent actors within an organisation.

Summary of Capabilities and Services
• Developing custom insider threat solutions
• Forensic collection, and analysis of technical and behavioural data
• Employee monitoring
• Document content analysis
• Behaviour analysis
• Forensic analysis and data recovery
• Expert witness service
• Recruitment support
• IT security reviews


Developing custom insider threat solutions
Our model considers multiple components of an insider threat mitigation programme. We deliver advice around
the technical and operational capabilities in order to secure your most valuable digital assets, and provide advice
around which types of software should be installed as part of an employee usage and monitoring strategy. We will
advise you about the personnel information that should be gathered from the recruitment phase, and during
regular employment reviews. Similarly we will help you implement an adequate termination process.
Recruitment support

As part of the recruitment process, Forensic Control can assess the appropriateness of prospective employees by
considering behaviour and social interaction. Our specialists can identify markers which aid in establishing a level
of risk and the likelihood of threat. For particularly high risk positions, a detailed personal history interview should
be conducted and include and in-depth personal background check.
IT security reviews
We deliver advice around the specific policies and procedures that should be adopted in order to prevent loss of
data and other types of security breach. This includes acceptable use policies and the education of senior
management around best security practices.

Employee monitoring
We can help identify which of your roles and which of your staff exhibit high risk of insider threat. Working
closely with your HR and legal functions we can remotely monitor the use of computers in order to collect
relevant data; this may be the content of their Gmail emails, instant messenger chats, the websites they visit and
so forth. We can record every action taken on a computer, and present to you without any knowledge of the
computer’s user. Crucially, we can detect anomalous user behavior on a computer, including increased
communication and the distribution of sensitive data to external recipients.

Document content analysis
Psycholinguistic content analysis is another powerful predictor of the likelihood of attack by a particular insider.
As part of the employee monitoring system, Forensic Control will analyse data gathered by information systems
qualitatively and quantitatively, using content analysis software which uses algorithms designed to correspond to
specific psychological states or issues.

Behaviour analysis
There are a number of behavioural markers that aid in the prediction of an insider attack. When coupled with
individual psychometrics, this data adds to baseline statistics which allow for the identification of anomalies in
behaviour, and serve to predict an insider attack or herald a security breach. We recommend that this data should
also be gathered as part of pre-employment screening, and form part of a regular review process.


Data acquisition
Digital data acquisition is critical in an investigation, as non-forensic acquisition (commonly carried out by
untrained IT staff) can often destroy vital electronic evidence. Forensic Control acquire data in a forensically
sound, court admissible manner from PCs, laptops, servers, mobile phones and tablet devices. Data can be
acquired directly from the storage device itself or over a network. Data acquisitions can be carried out covertly
or out of hours if required.
Forensic analysis and data recovery
Analysis of data is conducted using what we believe to be the best forensic analysis software available in the hands
of highly experienced analysts. This ensures the most thorough analysis possible. If data is recoverable in any way,
then we can get at it, collate it and present it to you in a human-readable format. We’ll show the provenance of
our findings making the results highly compelling. We’re happy to explain technical concepts and to provide
opinion where required.

Expert witness
Our associates include the some of the most highly regarded and experience computer expert witnesses in the
country. Veterans of dozens of court appearances, they provide independent opinion on contentious matters
involving data and its interpretation both in high-value civil cases and criminal matters.

Get in touch
Contact us for more information.