Cloud Computing Forensics Readiness

• Reducing the cost of cyber investigations;
• Quick determination of relevant attack vector;
• Reduction in the cost for data disclosure;
• Faster restoration from damage; and
• Cyber insurance discounts.

• Forensics data collection;
• Elastic, static and live forensics;
• Evidence segregation;
• Investigations in virtualized environments; and
• Pro-active preparations.

•  Investigators: Responsible for collaborative investigation allegations of misconduct in the Cloud and working with external assistance or law enforcement when needed.
• IT Professionals: System, network, and security administrators, ethical hackers, cloud security architect, and technical support staff in the cloud organization.
• Incident Handlers: The team that responds to a variety of specific security incidents, such as unauthorized data access, accidental data leakage and data loss, breach of tenant confidentiality, inappropriate system usage, malicious code infections, malicious insider attack, (distributed) denial of service attacks, etc.
• Legal Advisors: Staff familiar with multi-jurisdiction and multi-tenant issues in the Cloud that will ensure that any forensic activities will not violate regulations under respective jurisdiction(s) or confidentialities of other tenant(s) sharing the same resource(s).
•  External Assistance: Typically, it is wise for the cloud organizations to rely on a combination of its own staff and external parties to perform forensic tasks such as e-discovery, investigations on civil cases, investigations on external chain of dependencies. The responsibility of any external party should be determined in advance and made clear relevant policies, guidelines and agreements.

• Preparation: Create and maintain the conditions that enable you to respond timely and effectively to any digital incident.
• Partnering: Forge relations with and external specialists and stakeholders when it comes to dealing with digital incidents before a crisis occurs.
• Evolving: Periodically rehearse, evaluate and update your response plan.

( Thank you. If you enjoyed this article, get free updates by email or RSS – © Copyright Kevin L. Jackson 2016)