If you're using a live Linux distribution, you will probably need to guide the auditee into changing the BIOS settings for enabling the computer to boot from a USB stick. If we use sshuttle, net-tools needs to be installed on the auditee's side. This package is installed by default in Ubuntu. Scenario 2 In the case of remote desktop: Clean PC connected to the local auditee LAN network Stable and fast Internet connection at both ends TeamViewer client installed on the local clean machine. (Windows remote desktop can also be used.) TeamViewer installed on the auditor's machine In the case of using an in-the-middle trusted VPN server: A PC connected to the local auditee's LAN network Stable and fast Internet connection at both ends OpenVPN client installed on the local clean machine OpenVPN client installed on the auditor's machine A trusted OpenVPN Server Applications to use : TightVNC TeamViewer Windows remote desktop Considerations Scenario 1 Make sure that the auditee downloads the Linux image over TLS and guide them through the verification process (instructions for Ubuntu can be found here). When starting a live Linux distribution, make sure the auditee has a secure communication channel with you on a different device than the one that will be rebooted - for example through Signal on an Android phone, or on a different computer. Warn the auditee that they should not press "install" when the live Linux distribution has started, else their hard disk will be formatted and they will lose their data. Make sure that a secure communication channel is in place for sending the ssh commands to the auditee. The server used for the middle connection should be updated and secured, or updated and ephemeral. Make sure to remove/clean any persistent connections once you are done with Page 62 of 240