Interview & Interrogation Techniques Flashcards

Why is it important for a cybersecurity investigator to avoid making promises of immunity or leniency during an interview?

Answer: Promises of leniency can render any resulting statements inadmissible and expose the organization to legal liability

Unauthorized promises of leniency can invalidate confessions or admissions as evidence and create legal liability for the investigator and their organization.

A forensic interview of a potential victim of social engineering reveals inconsistencies in their timeline. What is the best next step?

Answer: Use the cognitive interview technique to help the subject reconstruct the timeline more accurately before drawing conclusions

Memory is fallible, especially after stressful events; the cognitive interview helps reconstruct accurate timelines without leading the witness or prematurely assigning blame.

Which of the following is an example of a 'closed question' in an investigative interview?

Answer: Did you click on the link in the email?

Closed questions elicit a yes/no or limited factual response, as in 'Did you click on the link?', and are used strategically to confirm specific facts.

When interviewing a third-party vendor suspected of providing unauthorized access credentials, what unique consideration applies?

Answer: The investigator must consider the contractual and legal relationship with the vendor, including whether NDA or contract clauses affect the scope of the interview

Third-party vendor relationships are governed by contracts, NDAs, and potentially different legal jurisdictions, all of which affect what can be asked and how the interview must be structured.

What is the primary goal of the 'theme development' phase in an interrogation of a cybersecurity insider threat suspect?

Answer: To provide the suspect with moral or psychological justifications that make it easier for them to admit to the conduct

Theme development constructs a narrative that minimizes the psychological barrier to confession by offering the suspect a face-saving or morally understandable explanation for their actions.

An interviewer notices a subject displays signs of anxiety only when questions relate to a specific server. What is the investigative significance?

Answer: Selective anxiety linked to a specific topic may warrant deeper inquiry into the subject's knowledge of or involvement with that server

Topic-specific behavioral changes can signal areas of concern worth exploring more deeply, though they must be considered alongside all other investigative information.

In a post-breach interview program, why should investigators interview uninvolved employees in addition to suspects and victims?

Answer: Uninvolved employees may have observed behaviors or anomalies that serve as corroborating or contradictory evidence

Peripheral witnesses often possess valuable contextual information or have noticed unusual behaviors they did not initially connect to the incident.