Question

How does the various cloud service model and also the cloud deployment models affect where the Auditor or a Forencics expert might look into for digital evidence on an incident.

Give one or 2 example (say on a SaaS cloud the SaaS provider enables Audit and tracking for all fields or some fields and provide an interface to look for the same). Just one example.

Answer 1

1.

• Different cloud services like SaaS, IaaS and Paas service model provide different categories of information.
• Hence, for Forensic Expert different service models provide a different focus area of investigation on an event.
• This is explained with the help of infrastructure wise:
  IaaS:
  i. IaaS provides complete control over the OS. A forensic expert can connect to the operating system by contacting the cloud service and hence, issue commands.
  ii. IaaS also provides access to the middleware. So, as a result, Expert forensic can view the data flow between the two endpoints.
  iii. IaaS also give access to the runtime and forensic can check on the application start time and end time.
  iv. IaaS also provide access to data and applications.
  v. Access control is provided where the way of providing access to the users can be checked.
  PaaS:
  i. PaaS provides no access to the operating system, middleware or runtime.
  ii. It only provide access to the data and application layer and access control.
  iii. Hence, detecting the attack in Paas is difficult as compared to IaaS.
  iv. In the case of the PaaS model, the focus should be on the application development to find malicious code.
  SaaS:
  i. SaaS is more limited than PaaS.
  ii. Expert Forensic can only check on access control.
  iii. So, if there is the SaaS model, the focus should be on licensing and usage of the application.
• Thus, each deployment model helps Expert forensic where to investigate the event.

2.

• There are some software that are provided by the service providers for logging purposes.
• For Example, Sumo Logic is a software that helps to create logs for small to large business for any issue tracking.

Friend, this was a really nice question to answer. If you find my answer helpful, please like it. Thanks.