Everything You Need to Know About Cloud Forensics

Introduction

Cloud computing has gone from cutting-edge technology to a best practice for businesses of all sizes and industries. According to Flexera’s State of the Cloud report, 94% of companies now leverage cloud computing.

With the cloud in such widespread usage, it’s no surprise that cloud forensics is growing in popularity. One of the most important cloud security best practices have cloud forensic investigators ready after a cybersecurity incident.

So what is cloud forensics, exactly? Cloud forensics involves applying digital forensics and crime investigation techniques to cloud computing environments. This article will discuss everything you need to know about cloud forensics, including cloud forensic techniques, challenges, and how to become a cloud forensic expert.

What Is Cloud Forensics?

If you’re reading this, you’re likely already familiar with cloud computing: a technology that delivers various on-demand computing services to users over the Internet. These services include applications, databases, servers, networking, and more—all available on a rental or “pay as you go” basis.

Cloud forensics refers to the use of forensic techniques to investigate cloud environments. When unlawful or criminal behavior has occurred using the cloud as a medium, cloud forensics experts use their skills and knowledge to detect the individuals or groups responsible. Cloud forensics encompasses users of the cloud, both victims and perpetrators. For example, a company using cloud servers might be the victim of a data breach or denial of the service incident. Criminals themselves might also use the cloud to launch an attack.

As with other subfields of forensics, cloud forensic investigators must follow strict regulations to ensure their work is admissible in a court of law. This may involve obtaining court orders to search a cloud server, ensuring evidence has not been tampered with, and other necessary precautions.

Cloud forensics jobs are usually listed under titles such as “forensic computer analyst,” “IT security analyst,” and “cyber investigator.” According to PayScale, the median U.S. salary for these jobs ranges from roughly $60,000 to $100,000. These individuals may be employed by governments, law enforcement agencies, and large companies such as banks and healthcare organizations that are common cybercrime targets. They may work in-house or provide their services as external contractors.

There’s no universally agreed upon background necessary for cloud analytics jobs, and each organization will have its own criteria. Most employers look for candidates with at least a bachelor’s degree, although not necessarily in computer science or information technology. Going through cloud forensics training (such as a certification program) is usually essential, but some people can bypass this requirement with enough experience.

How Is Digital Forensics Different from Cloud Forensics?

Digital forensics is a branch of forensics that works with electronic devices and data to detect crimes, examine the paths of criminals, and analyze and preserve evidence for the use of law enforcement and prosecutors.

The domain of digital forensics encompasses a wide range of components in the IT environment: hard drives and other storage media; individual files; Internet and other networks; emails; mobile devices; databases; operating systems; computer memory; and more.

Some examples of popular digital forensics tools are:

• The Sleuth Kit (TSK) extracts information from hard disks and other storage
• Autopsy, a tool for examining hard disks that provides data on the operating system, owner, users, applications, Internet history, deleted files, etc.
• Volatility, an open-source framework for analyzing computer memory

Once these tools have identified potential evidence, digital forensic experts can use a write blocker to securely copy the data to another location, recover hidden or deleted files, decrypt encrypted files, and more.

Cloud forensics can be considered a subset of digital forensics with a particular focus on cloud computing — and, thus, a subset of the broader sphere of forensic science. Many cloud forensic techniques and tools are therefore common in digital forensics. Like digital forensics, cloud forensic experts must work with diverse computing assets: servers, networks, applications, databases and storage, and more.

However, several factors make cloud forensics distinct from its parent field of digital forensics. Perhaps the biggest distinction is that cloud forensic investigators often lack physical access to the investigated systems and environments. This fact significantly affects how cloud forensic investigations are carried out, as we’ll see in the next section.

Challenges of Cloud Forensics

As you can imagine, several cloud forensics challenges are unique to this field. The challenges of cloud forensics include both legal and technical difficulties. The potential issues with cloud forensic analysis include:

• Jurisdiction complications: Cloud services are often hosted in different states or countries from the user’s location. Users can sometimes — but not always — choose this location. Google, for example, has cloud servers in North and South America, Europe, Asia, and Australia. This can create complications when determining which jurisdiction has authority over the crime.
• Instability: In traditional digital forensics investigations, the IT environment is often “frozen” to prevent interruptions or further issues while investigators complete their work. However, this is usually impossible with public cloud providers, which may serve thousands or millions of customers. Instead, the environment remains live and changeable (and therefore, potentially unstable.
• Physical access: In some cases, physically inspecting a cloud server can help with forensics. However, this is a challenge with large cloud providers, which enact strict security regulations to prevent unauthorized individuals from entering the premises. In addition, as mentioned above, there’s no guarantee that the cloud server will be physically located close to the investigator.
• Decentralization: Cloud providers often store files across several machines or data centers to improve data availability and reliability. This decentralization and fragmentation make it more challenging to identify the problem and perform forensics.
• Unavailable or deleted data: Cloud providers may differ in terms of the information they provide to investigators. For example, log files may not be available. In addition, if the crime resulted in data being deleted, it becomes a challenge to reconstruct this data, identify the owner, and use it in cloud forensic analysis.

SOURCE: https://www.eccouncil.org/cybersecurity-exchange/computer-forensics/what-is-cloud-forensics/