ABSTRACT
In this chapter, we will tackle the most difficult question you will have to answer during the course of your investigation: “Is the ‘event’ really a security incident?” As you will see, often a purely benign (though, perhaps, disastrous in its effects) event is mistaken for a security incident. Even if the event really does represent a crime, there is a better-than-even chance that you will be challenged to prove it because cover-ups are fairly common.
