Facilitating Fluffy Forensics (a.k.a. Considerations for Cloud Forensics)
How do you do forensics and investigate the Cloud (as in Cloud Computing)? What are the legal issues surrounding the Cloud?
Cloud computing enables the rapid deployment of servers and applications, dynamic scalability of system resources, and helps businesses get products to market faster than ever before. Most organizations are aware of the benefits of adopting cloud architectures and many are becoming aware of the potential security risks. The majority of organizations, however, don’t realize the numerous challenges of conducting incident response (IR) activities and forensic investigations across public, private, and hybrid cloud environments.
It’s not all doom and gloom, however. The consumption model of cloud architectures actually lends itself to helping investigators conduct forensic and IR exercises faster and more efficiently than on a single workstation. For this to happen, however, the tools and techniques employed must evolve.
In this session, CloudPassage Director of Applied Security Research Andrew Hay will address the forensic and IR challenges of investigating servers and applications in cloud environments in addition to the opportunities that cloud presents to help expedite forensic investigations.
Topics that will be discussed include:
- Traditional forensics and IRCloud architectural challenges for responders
- Chain-of-custody and legal issues across architectures and regions
- How existing forensics/IR tools can help – and what they can do better
- Advantages of conducting forensics/IR in cloud environments