Computer Forensics and Incident Response in the Cloud

No ratings

Presented at ISSAinternationalcon 2014 by

Stephen Coty

As most security professionals know, effective incident response plans include physical access to servers, and the ability to scan logs and pull data from deep packet forensic devices. When this happens in the cloud, the incident takes place on your cloud server where there is no physical access or forensic devices in place to track it and much less visibility into network activity. However, by partnering with a cloud provider security practitioners can often gain far more access to the data and expertise they need to assist their security team with the investigation of the breach than they expect. This session offers a blueprint of capabilities cloud providers should have in place to help conduct computer forensics and obtain actionable intelligence including mining logs, cloning the server and reverse engineering the malware. The session will cover practical steps to establishing contact with a cloud provider, developing a working relationship and maintaining realistic expectations before incidents occur, allowing the audience to act when time is of the essence. In addition, this session will offer examples of real-life investigations performed by cloud provider incident response teams, giving the audience a perspective on ways in which cloud providers deploy forensic resources and what capabilities they plan to develop in the future.