I am trying to compile a list of areas one should be aware of when doing Incident Response on public cloud environments, e.g. a hybrid public cloud, where some services are provisioned in local data-center, while is in the cloud.
- Pulling RAM to do memory forensics will be hard, if not impossible, to do on a SAAS, PAAS, or similar service.
- Physical access to devices will in most cases be impossible. If you have to get the physical disk that stored illegal material, you are most likely out of luck.
- The service you are using may be limited, altered or in other ways different than what you are normally using. E.g. Azure SQL as a Service, you don't have a fully fledged database as you are used to. Plan for this.
Some concerns that is not directly impacted by Incident Handling, but my cause it to happen:
- Isolation vs. Multi-tenancy. In some way, you are going to share resources. Your cloud service may have other clients ruining it for your systems.
- The above may also apply to security. Compromise of one SAAS client, might lead to compromise of others if the vendor is not configured properly.
- VM Escape is a dreaded possibility. A compromise in the underlying hypervisor might compromise all hosts.
- If you're not familiar with the cloud service's ACL's, you may be unsuspectingly exposing services on the open internet, that you otherwise thought to be internal only.
- Cloud vendor may not be as dilligent as you when it comes to limiting physical access. #BadUSB
- Your data may be susceptible for e-discovery, even if you had nothing to do with the incident.
Does anyone have any other thoughts or concerns on how a public cloud may impact our incident handling? Preferably we could keep in mind the 6 phases too:
- Identification / Analysis
- Lesson Learned