Breast Cancer and Red Wine Essay Example | Topics and Well Written Essays - 1000 words

Breast Cancer and Red Wine - Essay Example From this essay it is clear that despite the dreaded nature and repercussions of those who apparently contracted this illness, experts on the subject have revealed that risk factors have been clearly identified and avoiding these would assist in ultimate prevention. The aim of the current discourse is to focus on presenting a discussion on breast cancer, including its description, the current statistics of those affected, the explanations on how various body systems get affected, and the medications or treatments recommended, especially that which was currently discovered, through drinking red wine.As the report declares  from the statistics provided by the Cancer Research UK (2012), it was revealed the breast cancer ranked second in the world’s most commonly diagnosed cancer as of 2008. In the United States, breast cancer was the most commonly diagnosed cancer among females, and â€Å"the most common cause of death from cancer among Hispanic women; as well as the second mo st common cause of death from cancer among white, black, Asian/Pacific Islander, and American Indian/Alaska Native women†.  Cancer was identified to originate from the cell. From the explanations provided in the NCI, the normal cells in the body mature, die, and get replaced by new ones. Somewhere in the process of growth and development, some error occurs. When cells are expected to naturally die and be replaced, some just do not die; or some new cells just emerge even when not needed.

Arguments against and for Reframing Labor Rights as Human Rights Assignment

Arguments against and for Reframing Labor Rights as Human Rights - Assignment Example The labor law on the other hand argues that although the Act may be helpful in filtering and filling some gaps in the framework of legal protection at the workplace, the general effect is quite limited. This is due to the narrow range of employment-related issues to which convention rights apply. In addition, the Act provides limited opportunities for direct and indirect enforcement of employees who claim to be victims of a breach by their employers (Bakan, 1997). The effect of the duty on courts to interpret legislation in a manner which gives effect to convention rights is likely to disappear through the narrow interpretation of the respective rights by the Strasbourg authorities and the equivocal nature f the rights themselves. Incorporation is not a substitute for carefully tailored legislation as it raises questions about the obligations under the international treaties in the social field like the Council of Europe’s Social Charter. The first argument for reframing labor rights as human rights is that human rights approach facilitates partnerships with human rights friends. In addition, the system works well with the inexorable internationalization of labor struggles, it allows the naming, blaming and shaming of labor abusers and it is more responsive to the current political and cultural zeitgeist as compared to the traditional labor arguments (Savage, 2009). A human rights reframing is likely to bring about authoritativeness to labor discourse that will never be achieved by trade unionists (Adams, 2008). The historical curve of labor organizations keeps on changing toward wage compression, equal pay for work of equal value as well as equal benefits bringing up the bottom at a faster pace than advancing the top. Some unions that had gone to two-tier contracts succeeded in reversing them when possible.  Ã‚  

IT Project Risk Management Research Paper Example | Topics and Well Written Essays - 3750 words

IT Project Risk Management - Research Paper Example Additionally, efficient and successful project management requires effective management of all avenues that bring uncertainty into the project. The paper is structured into phases that outline how project risk management typology can be achieved effectively. The phases include the define phase, focus phase, identify issue-phase, Structure the Issues phase, Clarify ownership phase, Estimate Variability phase, Evaluate Overall Implications phase, and manage implementation phase. Currently, knowledge has been earmarked as an indispensable ingredient to innovative companies and to their overall objective of maintaining a competitive advantage over their rivals. In particular, knowledge has become an important factor in the development of dynamic key competencies, as well as the vocal point for companies to meet their global ambitions (Talet, Zin & Houari, 2014). IT, in particular, has become an important tool in all-important sectors, and any organization will highly feel the impact of any failure of IT project management on competitive advantage. California Technology Agency (2011) asserts that most of the business managers are not privy of the magnitude IT-related risks in projects management a firm will be exposed. Most of these managers are only able to learn the value of IT-related risks after they have computed the amount of damage the risk has brought about. According to Leong California Technology Agency, (2011) past research studies have primarily be en concerned with how effective IT-related risks may be analyzed and compensated for. Therefore, it would be imperative for IT managers constantly to embrace the holistic view of IT project risk management rather than just focusing only on financial issues. There exist little empirical research studies showing the correct way of handling the management of the IT-related projects risks during the launching of the project. Though a myriad of studies have been done in regards to I.T project risk

ORGANIZATIONAL BEHAVIOR & LEADERSHIP Essay Example | Topics and Well Written Essays - 750 words

ORGANIZATIONAL BEHAVIOR & LEADERSHIP - Essay Example Thus, for this reason Employee 1 used to work even in the weekends for receiving the bonus (Podsakoff & Schriesheim, 1985). Coercive power refers to such situation when an employee is forced by managers to abide by the order as a means of punishment. It may lead to employees’ dissatisfaction in the job. The marketing manager of Corporation A wanted that entire marketing employees should comply with his orders and work for more hours in a week (Podsakoff & Schriesheim, 1985). Legitimate power means that it is the perception of employees that managers have the capacity to give orders depending on the position. In the marketing department of Corporation A, employees considered that managers had the right to order and encourage them due to his position (Podsakoff & Schriesheim, 1985). Referent power relates to the respect of employees towards managers. In this context, managers direct by citing examples and it exists basically upon trust. In the given scenario of Corporation A, Employee 3 who works in sales department had only 1 year experience in this organization. His personality was liked by each individual for his positive attitude and charismatic nature. In one of the meetings, he had suggested a project for sales growth and was appreciated by everyone. Though he had not led team before, the corporation gave him the responsibility to manage the team over the project after receiving admiration from colleagues (Podsakoff & Schriesheim, 1985). Expert power indicates that a particular employee has high skill level or specialized knowledge over others. Employee 2 is a Certified Public Accountant (CPA) of the corporation. He had only the specialized skill for the formation of financial statements of the corporation. For this reason, he negotiated with the accountant manager to work only four days in a week and manager allowed as there was no other

Advantages of television Essay Example for Free

Advantages of television Essay Television is as much a part of everyday life as eating and drinking. It is in fact a very natural part of daily life. 94 percent of European households own a television and make TV viewing an integral part of their day (*). Whether it is together with friends and family, in between and parallel to other activities (while cooking, while ironing etc. ) or as part of a moment alone while relaxing, TV plays a central role in most people’s lives. As such TV advertising is a powerful communication tool and as much a part of television viewing, as the programmes themselves. Television is as much a part of everyday life as eating and drinking. It is in fact a very natural part of daily life. 94 percent of European households own a television and make TV viewing an integral part of their day (*). Whether it is together with friends and family, in between and parallel to other activities (while cooking, while ironing etc. ) or as part of a moment alone while relaxing, TV plays a central role in most people’s lives. As such TV advertising is a powerful communication tool and as much a part of television viewing, as the programmes themselves. Television is as much a part of everyday life as eating and drinking. It is in fact a very natural part of daily life. 94 percent of European households own a television and make TV viewing an integral part of their day (*). Whether it is together with friends and family, in between and parallel to other activities (while cooking, while ironing etc. ) or as part of a moment alone while relaxing, TV plays a central role in most people’s lives. As such TV advertising is a powerful communication tool and as much a part of television viewing, as the programmes themselves. Television is as much a part of everyday life as eating and drinking. It is in fact a very natural part of daily life. 94 percent of European households own a television and make TV viewing an integral part of their day (*). Whether it is together with friends and family, in between and parallel to other activities (while cooking, while ironing etc. ) or as part of a moment alone while relaxing, TV plays a central role in most people’s lives. As such TV advertising is a powerful communication tool and as much a part of television viewing, as the programmes themselves. Television is as much a part of everyday life as eating and drinking. It is in fact a very natural part of daily life. 94 percent of European households own a television and make TV viewing an integral part of their day (*). Whether it is together with friends and family, in between and parallel to other activities (while cooking, while ironing etc. ) or as part of a moment alone while relaxing, TV plays a central role in most people’s lives. As such TV advertising is a powerful communication tool and as much a part of television viewing, as the programmes themselves. Television is as much a part of everyday life as eating and drinking. It is in fact a very natural part of daily life. 94 percent of European households own a television and make TV viewing an integral part of their day (*). Whether it is together with friends and family, in between and parallel to other activities (while cooking, while ironing etc. ) or as part of a moment alone while relaxing, TV plays a central role in most people’s lives. As such TV advertising is a powerful communication tool and as much a part of television viewing, as the programmes themselves.

Summary and Response Essay Example for Free

Summary and Response Essay Summary: In â€Å"You Have the Right to Remain a Target of Racial Profiling,† syndicated columnist Eugene Robinson tries to impress upon his readers that racial profiling is still utilized by today’s police force. Mr. Robinson utilizes statistics from the U.S. Department of Justice, Bureau of Justice Statistics, to make his point. These statistics are taken from the Federal criminal justice system. Based on these statistics, he states that minorities (primarily blacks) are at least twice as likely to have their vehicle searched on a routine traffic stop. Mr. Robinson further points out the fact that minorities are statistically more likely to receive a citation, where whites are more likely to receive a verbal warning. Finally, Mr. Robinson makes the statement that if all individuals pulled over were searched equally that police would uncover evidence of tens of thousands more crimes annually. This statement is not supported by Bureau of Justice Statistics, as is the rest of the article, but is strictly conjecture. Response: Your article titled, â€Å"You Have the Right to Remain a Target of Racial Profiling,† is a compelling argument that racial profiling still exists and is being used in our â€Å"Federal† police force. I emphasize â€Å"Federal† since the statistics you use are only gathered from Federal cases. You infer, through omission, that these statistics support all traffic violations. I must confess that I agree that it exists on some level everywhere, but not that it’s as ubiquitous as you claim. Profiling is nothing more than a compilation of words like determine, assess, judge, weigh, evaluate, etc. All are used to statistically determine a predictable manner. You erroneously use the term Racial Profiling when the statistics more accurately suggest the use of the approved profiling method called Offender Profiling. We, as a societ y, empower our police with the authority to do offender profiling in service to the public. I certainly don’t want to impede on an officers judgment, to conduct a search, based on your claims that it’s not done uniformly. Do you want to be solely responsible for coming up with a list of traffic stop DO’s and DON’Ts for officers? Remember, you would be held accountable for any adverse situations that come as a result. I can’t help but detect some underlying accusations of racism in your column. In your claims you simplify things down to the numbers, in an effort to appear objective, but your math seems to be in error. The Federal Bureau of Statistics doesn’t account for the extenuating circumstances associated with the traffic stops you cite. Each traffic stop is an individual case that must be handled accordingly. It can’t be boiled down to simple math. Both parties are equally responsible for their conduct during a traffic stop. You fairly admit that blacks are less willing to concede they have been caught dead to rights in a traffic stop, but seem to exonerate their admitted cynical behavior. You want to hold the officer responsible for not only himself, but the actions of the offender as well. Fair is fair, you can’t responsibly make accusations based on half facts and obviously biased conjecture. That type of rhetoric is designed to inflame racial prejudices rather than express umbrage about an unfair process. I wonder what you were really trying to say, and what ulterior motives you have.

Misuse Of Computers At The Workplace

Misuse Of Computers At The Workplace In general, the use of computers for illegal activities is an increasingly problem as virtually every commercial transaction occurs in the digital world. In addition, people spend a significant part of their lives at the workplace so that chances are high that any sort of misuse will occur. Internal and external threats to an organization are becoming prevalent. In order to manage the collection and handling of digital evidence, allowing it to be admissible in court, an organization needs to concentrate efforts in constituting mechanisms to effectively handle potential evidence for criminal investigations. In order to address that issue, I initially discuss how computers can be misused at the workplace, identify trends in the security incidents arena, and provide a quick view on the field of digital forensics science and cyber forensics. Later, I move to the context of the problem addressing issues of forensic readiness, admissibility of digital evidence, discovery, and practices for incident response. Finally, I convey a proposal aiming at proactively addressing issues of collection and admissibility of digital evidence. The background Misuse of computers at the workplace Computers can be misused at the workplace in a variety of different ways. From accessing inappropriate Internet sites to copying copyrighted material, such as music, video or software, employees can make offenses against the employer corporate policies. In addition, non-work related Internet activity, such as visiting sport sites, bidding online, trading stocks, shopping online, and collecting and sending jokes to co-workers may also infringe Information Security or Information Technology (IT) resources policies. It is known that one of the most common ways of computer misuse in the workplace is the utilization of corporate e-mail and the Internet for private use. Most companies use Internet as a powerful business tool, but sometimes the misuse of that asset could turn out to be very expensive as it consumes IT resources and affects negatively employee productivity, in addition to compromise security. Some businesses accept the personal use of IT resources at the workplace, but there is a faulty line that divides what is right and wrong in terms of personal use. Other more serious offenses may include access to unauthorized or confidential material, cyberstalking, identify and information theft, hacking, embezzlement, child pornography etc. Internal computers can also be used to commit fraud against the employer or its customers or suppliers. In some cases involving an employee accessing certain types of illegal websites, a company may be subject to criminal investigation.  [1]  Computer related evidence can also be used to investigate cases of bribes.  [2]   Companies from different sizes have some sort of security policy in place that helps shaping the adequate use of information technology (IT) assets or identifying misbehaviour. Those security policies may have been implemented in line with security standards, such as ISO/IEC 27001:2005  [3]  , ISO/IEC 27002:2005  [4]  and the Internet Security Forum (ISF)  [5]  , but initiatives in this area are normally linked to two important and quite different streams. First, financial obligations impose IT systems to have tight checks, such as access control and authorization procedures, segregation of duties, contingency plans etc. Second, IT departments establish security mechanisms to protect internal computers from external threats, such as viruses, network attacks, and phishing among others cyber threats. Such tasks are mostly performed by distinct teams, with different skills in the IT and business areas. Failures to protect the internal network can put companies in situations where information systems can be compromised, private or confidential information leaked, or even computers being used by criminal networks via botnets  [6]  . In cases like this, companies may find its computer systems confiscated for inspection as part of criminal investigation, in addition to being subject to damages in reputation. A recent survey from Ernst Young  [7]  shows an increase in the perception of internal threats related to information security. About 75% of respondents revealed that they are concerned with possible reprisal from employees recently separated from their organization. That may have had some impact originated from the recent global financial crisis, but it is also due to the increasing level of automation and value of digital assets present in almost all organizations. Another interesting finding of this survey is that the primary challenge to effectively delivering information security was the lack of appropriate resources.  [8]   The computer misuse act (UK) As a first important UK legislation designed to address computer crime, the Computer Misuse Act (CMA)  [9]  became law in 1990. It turned, for example, hacking and viruses dissemination criminal offenses. The Act identifies three computer misuse offences: Section 1 Unauthorised access to computer material (a program or data). Section 2 Unauthorised access to a computer system with intent to commit or facilitate the commission of a serious crime. Section 3 Unauthorised modification of computer material. A person is guilty of an offence under section 1 if: He causes a computer to perform any function with intent to secure access to any program or data held in any computer The access he intends to secure is unauthorised; and He knows at the time when he causes the computer to perform the function. The Section 2 deals with unauthorised access to computer systems with the specific intention of committing, or facilitating the commission, of a serious crime. A person is guilty of an offence under this section if he commits an offence under Section 1 with intent to commit or facilitate the commission of a further, sufficiently serious, offence. The Section 3 covers unauthorized modification of computerised information, and thus includes viruses and trojans  [10]  . A person is guilty of an offence under this section if: He does any act which causes an unauthorised modification of the contents of any computer; and At the time when he does the act he has the requisite intent and the requisite knowledge. The requisite intent is an aim to cause a modification of the contents of the computer and by so doing impair its operation or hinder access to it, or any data stored on it. The requisite knowledge is the awareness that any modification one intends to cause is unauthorised. The CMA is responsible for a variety of convictions, from nanny agencies (R v Susan Holmes 2008) to ex-employees (R v Ross Pearlstone one of the first).  [11]  One recent arrest under the CMA involved two suspected computer hackers that have been caught in Manchester in a major inquiry into a global internet fraud designed to steal personal details. The investigation focused on ZBot trojan, a malicious software or malware  [12]  that records online bank account details, passwords and credit card numbers to ultimately steal cash with that information. It also steals password of social network sites.  [13]   Trends in security incidents Large organizations are the ones more likely to have adequate Information Security Policies in place. The utilization of Information Security practices in general requires the availability of skilled and well-trained people, risk assessment procedures and well managed incident response procedures. To some extent, the implementation of such practices is available in most businesses. However, the last PWC Global Economic Crime Survey  [14]  shows that large organizations are the ones to report more frauds. The survey confirms that the larger the organization the bigger the relative number of reported incidents. It also showed an interesting trend in detections methods, which is pertinent to our analysis. For example, internal audit went down to 17% of cases in 2009 against 26% in 2005. In addition, fraud risk management rose to 14% in 2009 from 3% in 2005. Newly risk management approaches try to be more proactive as opposed to traditional audit procedures. That trend may also demon strate that manual procedures (mostly audits) are being replaced by more automation (fraud management systems). Digital forensics science and cyber forensics Digital forensic science can be defined as: The use of scientifically derived and proven methods toward the preservation, collection, interpretation, documentation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal, or helping to anticipate unauthorized actions shown to be disruptive to planned operations.  [15]   Carrier and Spafford (2003)  [16]  argue that digital evidence concerns with data in digital format that establishes a crime has been committed, thus it provides a link between a crime and its victim or perpetrator. A digital crime scene is therefore the electronic environment where digital evidence potentially exists. Evidences, which are made of bits and bytes, are part of the digital forensic science (DFS) realm, which also includes visual and audio evidences. As a subset of the DFS, the cyber forensics field focus on the investigation of evidences via scientific examination and analysis of digital data so that it can be used as admissible and verifiable evidence in a court law. Evidences in this field includes log files, equipment primary and volatile memory, storage media, software (code) and virtually any document in digital format, such as email, sms messages etc. Evidence in general must be admissible, authentic, complete, reliable and believable, therefore requirements for digital evidence are not different in essence. Fundamentally, the process of managing the lifecycle of digital evidence is the same as the physical evidence. It includes the following phases: preparation, response, collection, analysis, presentation, incident closure.  [17]  However, digital evidence is highly volatile and once it has been contaminated, it cannot come back to its original state.  [18]  The chain of custody is an essential condition for digital evidence admissibility and preservation. The context Threats to evidence collection Evidence may exist in logs, computer memory, hard disks, backup tapes, software and so on. IT organizations are normally the ones supporting the usage of IT assets that generates most of the digital evidence as a result of doing business. However, IT organizations provide services to their companies mostly using multivendor strategies. In addition, users are mobile and spread along several geographic areas; workstation and servers are hardly standardized; and vendors use different methods for proving services and are bound to complex service level agreements (SLAs) that penalize them when services are not available or running with poor performance. The focus is always on running services to the lowest possible cost with adequate performance and availability. Whenever a problem may exist damaging the availability of a system, analysts will try to recover the full capacity of that service. It may imply that systems will be, in a rush, restarted or have its logs and other files deleted to improve processing capacity. In addition, although storing costs have fallen considerably during the last years, mainly on the end user side, data-center storage has been still expensive. Therefore, the pressures coming from costs reduction programs can, as a result, compromise running an adequate storage strategy. Moreover, this have implications that will hinder storing data longer, and reduce backup/restore procedures. Forensic readiness In the context of enterprise security, forensic readiness may be defined as the ability of an organization to maximize its potential to use digital evidence whilst minimising the costs of an investigation.  [19]  An adequate management of digital evidence lifecycle may help an organization to mitigate the risk of doing business. It can support a legal dispute or a claim of intellectual property rights. It can also support internal disciplinary actions or even just show that due care has taken place in a particular process.  [20]   An initiative, which aims at supporting a forensic readiness program, would include:  [21]   Maximising an environments ability to collect credible digital evidence; Minimising the cost of forensics during an incident response. In a general perspective, the utilization of enterprise information security policies will facilitate forensic readiness initiatives. However, in any security incident there will be mostly focus on containment and recovery due to the short-term business critical issues.  [22]   In order to help organizations implement a practical forensics readiness initiative, Rowlingson (2004) suggests a 10-step approach, as follow:  [23]   Define the business scenarios that require digital evidence. Identify available sources of different types of potential evidence. Determine the evidence collection requirement. Establish a capacity for securely gathering legally admissible evidence to the requirement. Establish a policy for secure storage handling and potential evidence. Ensure monitoring is target to detect and deter major incidents. Specify circumstances when escalation to a full formal investigation should be launched. Train staff in incident awareness, so that all those involved understand their role in the digital evidence process and the legal sensitivities of evidence Document an evidence-based case describing the incident and its impact Ensure legal review to facilitate action in response to the incident. Rowlingson also highlights two types of evidences: background evidence and foreground evidence. While the first is collected and stored via normal business reasons, the second is gathered to detect crime, and more frequently done via monitoring. However, monitoring typically raises privacy issues consequently requiring alignment to local laws. The monitoring process may help identifying data correlation between different events, thus increasing the potential of digital evidence based investigations. Admissibility of digital evidence Digital evidence can be defined as any data stored or transmitted using a computer that support or refute a theory of how an offense occurred or that address critical elements of the offense such as intent or alibi  [24]  . Digital evidence is useful not only to address cyber crimes, but also in an extensive range of criminal investigations, such as homicides, child abuse, sex offenses, drug dealing, harassment, and so on. Dicarlo (2001) argues that the basic questions about admissibility of evidences are relevance, materiality, and competence. When evidence is considered relevant, material, and competent, and is not blocked by an exclusionary rule, hearsay for example, it is admissible. Evidence is relevant when it has any tendency to make the fact that it is offered to prove or disprove within certain probability. Evidence is material if it is offered to prove a fact that is at issue in the case. Evidence is then competent if the proof that is being offered meets certain traditional requirements of reliability.  [25]   Daubert  [26]  has posed a threshold test to validate an evidence competency as a class of evidence.  [27]  Digital forensic evidence proposed for admission in courts must meet two basic conditions; it must be relevant, and derived by scientifically sound method. The digital forensics field is highly technical and grounded on science, which in turn bring some challenges to forensics professionals. Initially, it requires specific skills to deal with as it can be challenging to handle. For example, pieces of bytes can be put together to recover a deleted email that would provide key information to a case. Nevertheless, it would require an exhausting work to collect, handle and find the significant data. A similar situation occurs when decoding information carried by wire or wireless networks. Additionally, the knowledge of the digital evidence environment and how it can be produced is essential for any investigation. In Loraine  [28]  , Judge Grimm (2007) remarkably considered the Federal Rules of Evidence regarding its admissibility and authentication. He confirmed that the way evidence is gathered, processed and produced have a significant impact on its admissibility. According to the court, evidence must be: Relevant; Authentic; If hearsay, allowable under the hearsay exceptions; Original, duplicate or supported by admissible secondary evidence; The probative value of such evidence cannot be outweighed by any unfair prejudice or other factors. Another important issue is that digital evidence, to some extent, is easily manipulated. It can purposely suffer modification from offenders or be accidently altered during the collection phase without obvious signs of distortion.  [29]  However, differently from physical evidences, it offers some particular features:  [30]   It can be duplicated. In fact, this is a common practice in investigations and aims at diminishing the risk of damages to the original. It is traceable. Appropriate tools can be used to determine if digital evidence has been modified or tampered when compared to the original copy. It is difficult to destroy. For example, deleted data can be recovered even if hard disk is damaged. It may contain metadata (data about data). For example, a deleted file can show when it was deleted and last modified. Electronic data discovery Electronic Data Discovery  [31]  is any process in which electronic data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal legal case.  [32]   The 2006 amendments in the US Federal Rules of Civil Procedure (FRCP)  [33]  were driven by the increasingly use of the electronic form as evidence in litigation. The FRCP refers to electronic data discoverable as Electronic Stored Information (ESI). It constituted a milestone in the field, which is requiring organizations to be better prepared to store and manage business records. In addition, it established the legal hold, which means that organizations are under the duty to preserve information if they reasonable anticipate that a lawsuit may commence.  [34]   Normally, following a court order, an electronic discovery procedure can be carried out offline or online, on a particular computer or in a network, for the purpose of obtaining critical evidence. Electronic data is clearly easier to be searched when compared to paper documents. In addition, data can be perpetuated if properly stored, or even recovered if once deleted. If an entity becomes involved in a lawsuit, it will probably be requested to provide information that is in digital form. It is essential to be able to identify where and how the information can be retrieved. In preparation for electronic discovery, an enterprise will likely have to face the following issues:  [35]   Changes in business process to identify, collect and manage business records and knowledge assets; Implementation of new systems, technology or consulting to manage the lifecycle of the electronic discovery; Need to instruct and inform employees about their responsibilities regarding the need to preserve information and make it discoverable. In a event that an organization cannot locate or retrieve discoverable information, it may be subject to penalties or even have the case turning to the opposite side.  [36]   Discoverable electronic information must be produced regardless of the device it is stored, its format, its location or type.  [37]  If the burden or cost to produce is not reasonable, then it does not need to be produced. However, courts are entitled to order the discovery in situations where a good cause would exist.  [38]   Chain of custody is a fundamental requirement of ESI. Electronic discover processes should demonstrated the integrity of documents from storage to retrieval. Without historical records, evidence can be held inadmissible. Metadata per se is contestable as digital evidence; however, it can support the integrity and traceability of evidences. The FRCP also provide that one side may be required to grant the other access to a specific computer system as part of a discovery request, including technical support for that.  [39]  The whole aspect of maintaining an appropriate environment to locate, secure, and search discoverable information, increase the need to maintain IT tools that better support ESI processes. Although IT departments within organizations are the ones on duty to guarantee the technical means to preserve and recover ESI, electronic discovery as such is an evolving field that requires more than technology. Moreover, it may rise legal, jurisdictional, security and personal privacy issues, which still need to better assessed. Practices for incident response Every incident is unique and can incorporate many different areas of the affected organization. A right response to incidents requires an appropriate level of planning and coordination. In spite of being a critical element of any information security policy, incident response is one of the least practiced, most stressful, highly scrutinized task as it requires that incident analysts be well prepared in advance, be quick and calm, and act considering a wide range of possibilities.  [40]   Common cases of information security incidents may include economic espionage, intellectual property theft, unauthorized access to data, stolen passwords, unauthorized or inappropriate use of email and web, malicious code, such as worms with backdoors or trojans, and insider threats. In dealing with breaches, organizations face the following common challenges:  [41]   Misunderstanding of risks; Limited understanding of where sensitive data are collected, used, stored, shared and destroyed; Insufficient emphasis on secure coding practices and security quality assurance; Permissive access; No information classification; Flat architecture; Duties not segregated; Third-party connectivity/access; No access controls and limited physical controls; End-use computing vulnerabilities; Limited role and activity based training and guidance. The ISO/IEC 27002:2005 is a Code of Practice for Information Security Management. It is a well-known guide for the subject and widely used within private organizations as a reference for the information security management. The Section 13 Information Security Incident Management deals with information security events, incidents and weaknesses. It intends to provide a framework and a starting point for developing a cyber threat response and reporting capability. It says incidents should be promptly reported and properly managed. An incident reporting or alarm procedure is required, plus the associated response and escalation procedures. There should be a central point of contact, and all employees, contractors etc should be informed of their incident reporting responsibilities.  [42]   In addition, responsibilities and procedures are required to manage incidents consistently and effectively, to implement continuous improvement (learning the lessons), and to collect forensic evidence. An organization must respond in some way to a computer security breach whether it is an intrusion/hack, the implantation of malicious code such as a virus or worm, or a denial of service attack. The better prepared the organization is to respond quickly and effectively, the better the chance it will have to minimize the damage.  [43]   The ISACA ´s Cybercrime: Incident Response and Digital Forensics  [44]  internal control checklist recognize the following steps for reacting efficiently and quickly to information security-related incidents: Pre-incident; Immediate action; Secondary action; Evidence collection; Corrective measures; Evaluation. Systems administrators duties Statistics in general indicate that companies are more and more subject to internal and external attacks. The digital economy is pervasive and more and more documents now appear to exist only in electronic means. Even social engineering techniques, which many times target non-authorized physical access, will leave electronic traces in some way. Thus, system and network administrators are many times the first ones to get to know that security incidents or breaches are taking place. The appropriate procedure to collect evidence is vital to the success of any certain case. It is fundamental to understand how to collect evidence, how it may be interpreted and what data will be available to trace criminal actions.  [45]   The AAA  [46]  architecture, defined by the RFC 2903  [47]  , is a familiar concept for system and network professionals, and useful when considering forensics. The model is based on key information security concepts: authentication, authorization and accounting. Authentication is concerned with the process of positively identifying a user, process or service and ensuring that they have sufficient credentials to enter and use systems and resources. Each usually requires information (account user names and passwords being a good example) that differentiates them uniquely and hopefully undisguisably. Authorization is concerned with ensuring that resource requests will be granted or denied according to the permission level of the requester. Accounting is concerned with the monitoring and tracking system activities. From a network security perspective, accounting is often called auditing. Auditing is the process of logging communications links, networks, systems and related resources to ensure that they may be analysed at a later date. Accurate and detaile