SEC315 Wk6 d1

 "Evidence Collection"  Please respond to the following: 

• As a  security administrator, if you believe that suspicious activity may be  taking place, explain at what point you become concerned about the chain  of custody for potential evidence.
• Describe the approach  necessary to ensure that all evidence is gathered properly and that the  chain of custody has been maintained. Then, evaluate which step in the  outlined approach is the most likely to be skipped or not executed  properly.