Cloud Breach - Forensics Audit Planning
2 likes•1,996 views
The document discusses the complexities of conducting forensic audits on cloud computing services, highlighting challenges such as data acquisition, cooperation from cloud providers, and the integrity of logs. It details various forensic and anti-forensic processes, emphasizing the importance of security practices for cloud service providers. Additionally, the document identifies essential issues in cloud forensics, including legal considerations and the reliability of forensic tools in processing cloud data.
Cloud Breach - Forensics Audit Planning
- 1. Cloud Breach - Forensics Audit Planning InfoSecCon Raleigh, NC October 2014
- 2. Cloud Breach - Forensics Audit Planning GOALS ● Why it is more complex to answer: - Who, what, when, where & how (security analytics) ● Service level Agreements (SLA) ● Aid your cloud-computing security audit planning
- 3. Your CIO hears from the CEO and CFO. The FBI is investigating why your next billion $$ pharmaceutical cancer drug is on-line. This confidential information was found on the servers of a global Cloud Service provider exposed and unprotected.
- 4. Cloud Breach - Forensics Audit Planning 1. Cloud Architecture Overview 2. Cloud Forensics a. Forensic Data Sources a. logging b. Trusted Data c. Virtual Machines d. Federated (shared) Services e. Cloud Brokers 3. Cloud Service Providers a. Dropbox b. SalesForce.com / Force.com c. Amazon.com Web Services 4. Cloud Anti Forensics 5. Summary
- 9. Cloud Service Architecture (shared responsibilty)
- 10. Cloud Breach Forensic Data Sources ● Access logs ● API Management logs ● Security logs (firewall, IDS, opensource tools, etc.,) ● Billing records ● Metadata - application ● Netflow, Packet Capture ● Physical drives ● Virtual drives ● Guest OS data ● Cloud data storage ● Certificate and private Keys
- 11. Cloud Breach Forensics Forensics Process Flow
- 12. Cloud Forensics Logs Issues ● Decentralization of logs ● Volatility of logs ● Multiple tiers and layers ● Archival and retention ● Accessibility of logs ● Non existence of logs ● Absence of critical information in logs ● Non compatible / random log formats - Cloud Application Logging for Forensics (Raffael Marty, 2011)
- 13. Cloud Forensic Data Trust - definition: Forensically sound in consideration of the evidentiary integrity of the electronically stored information (ESI)
- 14. Cloud Forensic Data Trust - definition: Forensically sound in consideration of the evidentiary integrity of the electronically stored information (ESI)
- 15. Cloud Forensic Data Virtual Machine (VM) IaaS ●
- 16. Cloud Forensic Data (IaaS) J. Dykstra and A. T. Sherman, 2012 - Acquiring Forensic Evidence from Infrastructure-as-a-Service Cloud Computing: Forensic evidence tools & the time to retrieve the data and trust requirements - Amazon Web Services (AWS) EC2 components
- 17. Cloud Forensic Data VM Snapshot
- 18. Cloud Forensic Data VM Hypervisor Types - 1 & 2
- 19. Cloud Forensic Data VM Commercial Hypervisors KVM is used by Redhat Enterprise Virtualization (RHEV). Xen Server hypervisor by Citrix Inc. Vmware Inc. vSphere uses VMware’s ESXi hypervisor. Hyper-V is a commercial hypervisor provided by Microsoft.
- 20. Cloud Forensic Data Federated (shared) Storage
- 21. Cloud Forensic Data Federated (shared) Services
- 22. Cloud Forensic Data Cloud Brokers NIST SP 500-292 (Cloud Brokers) Manages the use, performance and delivery of cloud services, and negotiates relationships between Cloud Providers and Cloud Consumers. (“Adds value” – Gartner Research)
- 23. Cloud Brokers (maturity model) NIST SP 500-292 (Cloud Brokers) Manages the use, performance and delivery of cloud services, and negotiates relationships between Cloud Providers and Cloud Consumers.
- 24. Cloud Breach - Forensics Audit Planning Issues:
- 26. Cloud Services Providers Dropbox Security Services $$$
- 28. Single Sign-On: SAML Assertion (3rd Party) * Delegated Authentication Single Sign-On * MS Active Directory, IBM, HP, Ping Identity, NetIQ, etc.,
- 29. Cloud Services Providers Force.com - Software Developers Separation of duties: - Authentication, Authorization, Accounting and Auditing - Role-based Access Control (RBAC) - User Access Reviews (logs) API management - (Mashery, Intel, etc.,) Key & Certificate Management - (Venafi, Entrust, Comodo, etc.,)
- 31. Cloud Services Providers Security Best Practices Nov 4, 2013
- 32. Cloud Services Providers AWS Shared Responsibility Model for Infrastructure Services
- 33. Cloud Services Providers AWS Audit Security Tips - Limited access to administrative ports to only a few IP addresses - ports 22 (SSH), 3389 (RDP), and 5500 (VNC). - Limited access to common database ports: - 1433 (MSSQL Server), 1434 (MSSQL Monitor), 3306 (MySQL), Oracle (1521) and 5432 (PostgreSQL). - Identity & Access Management is configured to help ensure secure access control of AWS resources. - Multi-factor authentication (MFA) token is enabled to provide two-factor authentication for API (Ruby, .NET, Python, PHP, etc.,) access to the root AWS account. Access keys are used to digitally sign API calls made to AWS services. Each access key credential is comprised of an access key ID and a secret key.
- 34. Cloud Services Providers AWS Audit Security Tips Identity Access Management ● MS Active Directory, LDAP, Kerebros integration ● Single Sign On / Identity Federation - CA CloudMinder, SailPoint, Okta, OneLogin, Ping Identity, etc., ● Role Based Access Controls - Assign permissions to groups, not users. ● Administrators should have individual accounts
- 35. Cloud Services Providers AWS Cloud Trail - Logs any action performed via the APIs or web console into an S3 storage bucket or Glacier archiving storage - Gives complete audit trail of all changes in your account. - Set up the S3 (storage) bucket with versioning to prevent tampering of your logs - Analyzed by Splunk, Sumo Logic, etc. - can add AWS CloudWatch API activity
- 36. Cloud Services Providers AWS Cloud Trail – use case Vodafone Australia - Elastic Compute Cloud (EC2) ● Trend Micro Inc. and Xceedium, Inc.'s Xsuite with Amazon’s native security groups ● Set up multiple virtual private clouds (VPC), ● A separate VPC for security tools ● Trend Micro’s Deep Security tool, integrated with AWS APIs,for centralized visibility into the VPCs ● Deep Security agent on every Amazon Machine Image (AMI) deployed using Opscode Chef recipes. ● The Chef-based automation of Deep Security deployment - for automation, elasticity, and traffic auditing.
- 37. Cloud Services Providers Amazon Cloudwatch Monitors API activity and delivers log files Developers / system administrators to collect and track metrics, Monitors Amazon EC2 and Amazon RDS DB instances system wide (Zones East , West, Ireland, etc.,) Programs retrieve your monitoring data, view graphs, and set alarms, spot trends Take automated action based on the state of your cloud environment.
- 38. Cloud Anti Forensics Critical - Time to detect and react to an incident - earlier in attack chain, less loss, less damage, & more forensic evidence Cyber criminals remove audit trail, logs. ...
- 39. Cloud Anti Forensics Denial of Service (DoS / DDoS) Destroy Virtual machine (server / application) Destroy virtual storage Hide virtual infrastructure - routers, switches,(turn off) Corrupt forensic data Hashes, certificates, keys Timestamps (NTP) File signatures Logs deleted Hypervisor security manipulated
- 40. Key Issues in Cloud Forensics 1. Acquisition of data is more difficult 2. Cooperation from cloud providers is paramount. 3. Cloud data may lack key forensic attributes. 4. Current forensic tools are unprepared to process cloud data. 5. Chain of custody is more complex.
- 41. Join the Fight ? Valdez Ladd, MBA – ISM, CISA, CISSP , www.linkedin.com/in/valdezlad
- 42. NIST Cloud Computing Forensic Science Challenges (Draft) NISTIR 8006 “Digital Forensics is the application of science to the identification, examination, collection, and analysis of data while preserving the information and maintaining a strict chain of custody for the data.” NIST Cloud Computing Forensic Science Challenges (Draft NIST IR 8006) Major Issues: Architecture (e.g., diversity, complexity, provenance, multi-tenancy, data segregation, etc.) Data collection (e.g., data integrity, data recovery, data location, imaging, etc.) Analysis (e.g., correlation, reconstruction, time synchronization, logs, meta-data, timelines, etc.) Incident first responders (e.g., trustworthiness of cloud providers, response time, reconstruction, etc.) Role management (e.g., data owners, identity management, users,access control, etc.) Legal (e.g., jurisdictions, laws, service level agreements, contracts, subpoenas, international cooperation, privacy, ethics, etc.) Standards (e.g.,standard operating procedures, interoperability, testing, validation, etc.) - Training (e.g., forensic investigators, cloud providers, qualification, certification, etc. Anti-forensics (e.g., obfuscation, data hiding, malware, etc.)
- 43. The identification, collection, and preservation of media can be particularly challenging in a cloud computing environment given several possible factors, including: 1) Identification of the cloud provider and its partners. This is needed to better understand the environment and thus address the factors below. 2) The ability to conclusively identify the proper accounts held within the cloud by a consumer, especially if different cyber personas are used. 3) The ability of the forensics examiner to gain access to the desired media. 4) Obtaining assistance of the CSP : cloud infrastructure/application provider service staff. 5) Understanding the topology, proprietary policies, and storage system within the cloud. 6) Once access is obtained, the examiner’s ability to complete a forensically sound image of the media. 7) The sheer volume of data with the storage media. 8) The ability to respond in a timely fashion to more than one physical location if necessary. 9) E-discovery, log file collection and privacy rights given a multi-tenancy system. (How does one collect the set of log files applicable for this matter versus extraneous information with possible privacy rights protections?) 10) Validation of the forensic image. 11) The ability to perform analysis on encrypted data and the collector’s ability to obtain keys for decryption. The storage system no longer being local. There is often no way to link given evidence to a particular suspect other than by relying on the cloud provider’s word. This draft was prepared by the NIST Cloud Computing Forensic Science Working Group. The report summarizes 65 challenges cloud computing presents to forensics investigators who sift through bits and bytes of digital evidence to solve crimes. They categorize the challenges into three domains as technical, legal and organizational.
- 44. References Image: Cloud Forensics Process Flow, slides 11, 25 Cloud Forensics: A Meta-Study of Challenges, Approaches, and Open Problems S Zawoad, R Hasan - arXiv preprint arXiv:1302.6312, 2013 Image: Virtual Machine Quinescence, slide 17 Investigating the Implications of Virtual Machine Introspection for Digital Forensics Citation K. Nance, B. Hay, and M. Bishop, “Investigating the Implications of Virtual Machine Introspection for Digital Forensicsk,” Proceedings of the 2009 International Conference on Availability, Reliability and Security pp. 1024–1029 (Mar. 2009). *** Copyrights handled in accordance with “Fair Use” for educational purposes ***
- 45. References Image – slide 17 Acquiring Forensic Evidence from Infrastructure-as-a- Service Cloud Computing: Amazon.com web services J.Dykstra and A. T. Sherman, April 2012 Acquiring Forensic Evidence from Infrastructure-as-a-Service Cloud Computing: Exploring and Evaluating Tools, Trust, and Techniques Josiah Dykstra and Alan T. Sherman, www.cisa.umbc.edu/papers/DFRWS2012_Dykstra.pdf Cyber Defense Lab, Department of CSEE University of Maryland, Baltimore County (UMBC) *** Copyrights handled in accordance with “Fair Use” for educational purposes ***