Question

A cloud customer has asked you to do a forensics analysis of data stored on a CSP’s server. The customer’s attorney explains that the CSP offers little support for data acquisition and analysis but will help with data collection for a fee. The attorney asks you to prepare a memo with detailed questions of what you need to know to perform this task. She plans to use this memo to negotiate for services you’ll provide in collecting and analyzing evidence. Write a one- to two-page memo with questions to ask the CSP.

Answer according to digital forensics

Answer 1

ANSWER:-

If CSP doesn’t have limited staff, ask the following questions to understand how the CSP is set up:-

• Does the investigator have the ability to use cloud staff conduct an analysis?
• Is the detailed knowledge of cloud topology, the storage devices is available?
• Are there any limitations on collecting digital evidence from cloud storage space?
• For e-discovery demands on multitenant cloud systems, is the data of investigation is local or remote?
• What is the CSP's relationship with cloud users?
• What are the SLA's and what are the guidelines to define them?
• SLAs should also specify support options, penalties for services not provided, system performance, fees and provided software/hardware?
• CSP must state who is official to access the data? And the limitations for conducting acquisitions for an analysis?
• Digital forensics should review CSP's policies, standards guidelines for daily operation?
• What are the CSP's business stability and failure recovery plans?

Jurisdiction issues:-

• Are there any plans to rework current laws?
• Are there any cases linking data coming with other customer's data?
• Ask what laws are control data stored in the cloud is disputes?
• How privacy rights are defined in different jurisdictions?
• Is a major factor in problems to access the data?
• Protect private information and consult with legal experts to be aware of possible limitations in an investigation connecting cloud data?

To access evidence in the cloud:-

• Are there any court orders with prior notice, search warrants etc?
• What is the pattern of the CSP?
• Is the data storage location is secretly kept or it is open?
• What are the actions for log keeping? So that they will not make difficult an investigations chain of evidence?
• Is there any threat from hackers so that they will not use any malware and modify the file Meta data?
• Does CSP have a personnel trained employees to respond to network incidents?
• Who are the data owners; indentify protection, users and access controls for a better role administration?
• What is the right encryption key to decrypt the data if at all the CSP has provided encryption to the data?