Instructor: Cloud Forensics. 2 2
In this lesson, we're going to talk 3 3
about some of the challenges with Cloud Forensics. 4 4
Now, we covered a lot of Digital Forensics 5 5
back earlier in this course, 6 6
when we covered the entire Digital Forensics Section, 7 7
but there are some unique things that we have to think 8 8
about when we deal with the Cloud. 9 9
For instance, when you start dealing 10 10
with Digital Forensics in the Cloud, 11 11
it becomes much more challenging. 12 12
This is because all of the resources you're talking about, 13 13
the servers, the networks and the disc storage, 14 14
is all technically virtual stuff, it's not physical. 15 15
This means that you may not have access to it. 16 16
So because it's virtual, you can logically access it, 17 17
but you can't do a physical disc image of that disc, 18 18
because that disc could be located anywhere in the world. 19 19
It might be located in multiple regions of the world. 20 20
And it might have data that's spread 21 21
out across multiple data centers all at the same time. 22 22
Now, this makes it so much harder for you 23 23
to be able to get that data. 24 24
Now, on the other side of things, 25 25
the Cloud makes it a lot easier for attackers as well. 26 26
Attackers can use any of a number of Clouds 27 27
to perform their attack. 28 28
And many attackers will actually create 29 29
a multicloud service for them 30 30
to be able to create their own attack platform. 31 31
And so when you're trying to investigate 32 32
the source of an attack and you look at the IP, 33 33
you may find that it's coming from Amazon Web Services 34 34
or Microsoft Azure or the Google Cloud Platform. 35 35
All of these could be the source of your attack, 36 36
but it's not likely that Amazon or Microsoft or Google, 37 37
are the ones performing it. 38 38
Instead, it's an attacker who leased 39 39
some kind of an instance, 40 40
and then they're using that to perform their attack. 41 41
Now, throughout the rest of this lesson, 42 42
I want to focus on three main points that you need to consider 43 43
in terms of the difficulty with Cloud Forensics. 44 44
First, when you talk about performing forensics 45 45
in a Public Cloud, this is going to be complicated, 46 46
especially because the access you're allowed to have 47 47
and the access you're permitted is going to be based 48 48
on the Cloud provider's SLA, their Service Level Agreement. 49 49
For example, the SLA I have with my Cloud Service Provider, 50 50
doesn't allow me to jump in my car, 51 51
drive to their server farm, plug in my device, 52 52
and start doing a bit-by-bit copy of that server. 53 53
It's not allowed. 54 54
So if I want to get data or forensics performed 55 55
on my Cloud Instance, 56 56
I would have to ask them, 57 57
and they would have to do it for me. 58 58
And that's only if it's based on the SLA 59 59
and what I agree to pay them, 60 60
in terms of that SLA to do that work for me. 61 61
The second major concern is that instances 62 62
are created and destroyed very quickly, 63 63
due to the elasticity. 64 64
Now, this is a great thing in terms of our operations, 65 65
but from a forensic standpoint, 66 66
it makes recovery much more difficult. 67 67
As these instances are created, 68 68
they start taking up more disc space. 69 69
When they're done, they're deleted, 70 70
and that disc space becomes available again. 71 71
Then another customer might create a new instance, 72 72
and it writes over your data that was recently deleted, 73 73
making recovery much more difficult. 74 74
This is a big issue. 75 75
Now, a lot of Cloud Service Providers 76 76
realize this is an issue, 77 77
and so they start doing more extensive 78 78
logging and monitoring options to try to overcome this, 79 79
or take snapshots and keep them 80 80
for a certain amount of time to go back for data recovery. 81 81
But again, this is one of those things 82 82
that this is a benefit of the Cloud, 83 83
but it's also a drawback. 84 84
The benefit is the elasticity. 85 85
The drawback is it's harder to do forensic recovery. 86 86
The third issue we want to talk about here, 87 87
is that there are issues with chain of custody. 88 88
Now, this happens because the investigator 89 89
can't just go in and do the image themself. 90 90
Instead, they're relying on the cloud service provider 91 91
to provide them the data. 92 92
So if I want an image of my server, 93 93
I'm going to ask my service provider to do that for me. 94 94
Now, they're going to have to hopefully, 95 95
document and record that as closely as possible, 96 96
but again, they're not law enforcement, 97 97
and so it would be an issue 98 98
if we need a actual legal binding evidence collection here, 99 99
based on our jurisdiction, 100 100
because we wouldn't be able to get it. 101 101
The other issue here, 102 102
when you start talking about chain of custody, 103 103
is again, that data can be anywhere in the world. 104 104
So if my data's in a server farm in Thailand, 105 105
that means in Thailand, there's data sovereignty there. 106 106
But I'm a US company, I don't have data sovereignty 107 107
with my data being in Thailand. 108 108
Now, my data's not in Thailand, 109 109
but it's just giving you an example. 110 110
These are things you have to consider 111 111
when you start moving to the Cloud, 112 112
and they can make forensics much more challenging.