You work as a security administrator of a large department store chain or choose another large corporation of your choosing. You believe that there has been a breach in the VPN where an employee has stolen data using a personal laptop along with using the company assignment computer.

You review the logs from the IDS, remote access systems, and, file servers and confirm this belief. Your employer wishes to gain access to the personal laptop used for the breach to determine the full extent of the data stolen. The guilty employee's lawyer claims that the laptop is not identifiable.

Create a formal document to the CEO of the company to account for your findings, tools used to solve the breach and what steps will be taken to prevent this type of breach from happening again. You will also need to create a press release to the Public regarding this breach. Create a disaster recovery plan for the employees and vendors in case of a breach.

Things to consider: What would best be used to identify the specific laptop used for the theft? How would you acquire the identifying information? List some items that would NOT be useful to identify the specific computer used by the insider.