What is one practice that can help you to maintain a digital chain or custody In your network?

A digital chain of custody requires a verifiable and chronological record of all network events. Accurate and synchronized time stamping across all network devices is the most fundamental requirement for this. Using an authenticated Network Time Protocol (NTP) source ensures that all logs and event data are correlated to a trustworthy and consistent timeline. Without synchronized clocks, correlating events from different devices to reconstruct an incident becomes impossible, thereby breaking the chain of custody.

A. Continuous packet capturing on the datapath is a resource-intensive troubleshooting technique, not a sustainable practice for maintaining a long-term, verifiable evidence trail.
B. Continuous packet capturing on the control path is also for specific troubleshooting, not for establishing a general, long-term chain of custody for all network events.
D. The choice between RADIUS and TACACS+ is about AAA protocol features (e.g., command authorization), not the fundamental requirement of time synchronization for all logged events.

1. ArubaOS 8.6.0.0 User Guide, page 1003, "Configuring System Services > NTP Server": "For logs from different network devices to be useful, the clocks on those devices must be synchronized. You can synchronize the managed device's clock with a Network Time Protocol (NTP) server."

2. Kuyoro, S. O., Ibikunle, F., & Awodele, O. (2011). Network Forensics: A Review and Functional Architecture. International Journal of Computer Applications, 35(9), 1-6. (This academic review emphasizes time synchronization as a critical component of network forensic data collection, which is the basis of a chain of custody).