ABOUT THE AUTHOR


Gary Audin
Gary Audin is the President of Delphi, Inc. He has more than 40 years of computer, communications and security...
Read Full Bio >>
SHARE



Gary Audin | January 24, 2013 |

 
   

CSI for the Cloud

CSI for the Cloud Cloud computing expands the scale of digital forensic activities. It also creates new cybercrime investigations with new challenges.

Cloud computing expands the scale of digital forensic activities. It also creates new cybercrime investigations with new challenges.

Cloud computing is a service you cannot ignore. Gartner predicts that cloud service revenue will be about $150 billion in 2013. With all of this comes the growing amount of data that will be accumulated, and the implications of the use of the cloud for situations that require forensic analysis. The amount of data that needs to be analyzed can be tens to hundreds of gigabytes in a single investigation.

The forensic professional's goal is to obtain information that can be used in court, and cloud computing expands the scale of digital forensic activities. It also creates new cybercrime investigations with new challenges.

Cloud forensics means new experts with new tools. Cloud forensics is a combination of digital forensics and cloud computing. Cloud computing, by definition, means sharing resources such as networks, storage, servers, applications, and other services. The sharing is performed by the cloud service and it involves multiple enterprises using common solutions.

A major value of cloud computing is its ability to reconfigure resources quickly. This means that resources can change almost instantly, which in turn means that virtualization compounds the forensic data location problem.

XaaS Models and Forensics
The Infrastructure as a Service (IaaS) model produces the fewest obstacles for the forensic expert. It is basically providing a physical data center outside the enterprise, but with all of the enterprise's work performed by enterprise staff. The management of the operating system may be shared.

Platform as a Service (PaaS) adds the management of the runtime and middleware by the service provider. This adds to the complexity faced by the forensic professional.

Software as a Service (SaaS) effectively outsources the entire IT operation. The enterprise becomes a subscriber to the service. SaaS is the most difficult environment for the forensic professional to operate within because most of the control of the applications and data is with the SaaS service provider.

The structure of your cloud provider's business will depend on the business model they are working under. A SaaS provider can easily be running its service on an IaaS or PaaS cloud, therefore you will be really working with two providers, not one for forensic purposes. A third-party reseller may be the face of the cloud service, adding another layer to the arrangement.

Next page: Elements of cloud forensics



COMMENTS



November 5, 2014
With video collaboration expected to surpass email as the top means to communicate by 2016, organizational leaders are tasked with building flexible collaboration infrastructures that meet the demands...
October 22, 2014
As enterprises migrate from prior generations of communications technology into the future of Unified Communications, almost everyone has to deal with multiple vendors' systems. In the past, you would...
October 8, 2014
Today's fast pace of business combined with an environment of constant change creates stress on even the highest performing organizations. Join us for this interactive webinar to learn how to successf...