Arun is the CEO of SecureNext E-Commerce Pvt. Ltd., one of India's fastest-growing online platforms. The company specializes in providing engineering equipment, industrial solutions, and services to industries across the

Arun is the CEO of SecureNext E-Commerce Pvt. Ltd., one of India's fastest-growing online platforms. The company specializes in providing engineering equipment, industrial solutions, and services to industries across the country. Its rapid expansion has made it a crucial player in India's industrial supply chain, handling thousands to customer transactions everyday. The transactions involve sensitive payment information, vendor agreements, employee data, and proprietary product designs. This combination of intellectual property, financial records, and personal data makes SecureNext an attractive target for cybercriminals. As the business grows, the volume of data and the complexity of its IT infrastructure have also expanded, creating new cybersecurity challenges. Recently, SecureNext has been facing serious software security issues in its internal network. Unauthorized logins, SQL injection attempts, and ransomware alerts have created concern for both Arun and regulators. These events have alarmed not only Arun and his leadership team but also regulators and stakeholders. The Board of Directors has formally directed Arun to strengthen cybersecurity compliance and align reporting mechanisms with statutory requirements under the Information Technology Act, 2000, Digital Personal Data Protection (DPDP) Act, 2023, Sectoral advisories from CERT-In and the Reserve Bank of India (RBI), particularly for handling financial transactions. The first major crisis struck when SecureNext's application servers were targeted by a ransomware attempt. Investigations revealed the root causes are weak access controls, unpatched open-source libraries, and a lack of multi-factor authentication. The RBI and CERT-In advisories mandate regular patch management, encryption of sensitive data, and multifactor authentication for payment systems. To meet these requirements, Arun must institutionalize secure coding practices, roll out access control policies, and ensure detailed logging of user activity, while also filing timely compliance reports to regulators. To overcome scalability and resilience challenges, the company's member of advisory board, Mr. Deepak suggested adopting a cloud computing model where a provider delivers on-demand computing resources like servers, storage, and networking over the internet for flexibility and scalability, and offers benefits such as cost efficiency and disaster recovery, shared responsibility matrices, and provider responsibilities with hardware security, hypervisor patching and Customer responsibilities in application security, data protection, identity management. Before migration, SecureNext must prepare a compliance roadmap, demonstrating how security responsibilities will be divided between the cloud provider and the company. Arun realizes this decision requires deep knowledge of cloud architectue, statutory obligations, and forensic readiness. A troubling insider attack revealed further gaps in SecureNext's security posture. During foresnic investigations, it was discovered that the incident response team had failed to capture volatile evidence (RAM data such as session keys, temporary files, and unsaved logs) before the compromised system was rebooted. Since volatile evidence disappears once a system is powered down, this failure raised serious concerns. To fix this, Arun must ensure that forensic policies mandate the order of the volatility principle and use tools like FTK Imager and registry viewer, and establish standard operating procedures (SOPs) for handling live evidence during incident response. During the festival season, SecureNext faced a DDoS attack that temporarily crippled its main database, but operations were restored using remote recovery. As part of its cloud strategy, the company is conducting Disaster Recovery (DR) testing with geo-redundant backups and high-availability architecture. Meanwhile, an employee accused of data theft formatted his workstation to erase evidence. Forensic investigators recovered deleted files from unallocated disk space, but during legal proceedings, the defense challenged the evidence due to improper chain of custody, missing hash verification logs, and incomplete documentation. CEO Arun must now ensure robust cybersecurity measures, proper forensic protocols, and compliance with Indian regulations to strengthen resilience and maintain the admissibility of digital evidence in future incidents. From the above scenario, answer the following questions: SecureNext found a suspect's unauthorized data transfer from one of its servers. As a forensic investigator, you perform Live Forensics to capture volatile data. Analyze, why Live Forensics is the preferred method in this situation ? Describe the order of volatility you would follow during evidence collection, and Evalaute the potential risks if the live data is not collected immediately.