Question

After reading Chapter 13 and watching the videos, please read more about challenges of cloud forensics in a virtualized environment, then discuss the following: What challenges exist? You can provide solutions to those challenges if it helps.  

Answer 1

Cloud forensic is defined as applying the forensic principles in the cloud computing environment these include investigation of crimes by using digital forensic so it's a cross discipline between digital forensic and cloud computing.

The challenge in cloud forensic along with their solutions are

1)Decentralized data

• One of the challenge in cloud forensic is decentralized data as cloud computing allow data to be stored and distribute over many data center and physical machine so evidences are located at several locations making evidence collection difficult in cloud computing environment.
• The Solution for above issue is to have centralized log management (CLM)which pushes the log data to one central, accessible interface .The centralized log management allow user to easily and quickly access the data which is distributed in cloud computing.

2)Lack of log framework

• One of the most important problems in cloud forensic is collection and identification of logs from cloud infrastructure this is because that investigator not have proper control over distributed cloud infrastructure .
• The solution for this is that there would be secure login mechanisms for the investigators which provide them access to data and also maintaining the confidentiality of the cloud users.

3)volatile data

• In cloud computing environment these data is volatile which can be lost as soon as power of the main server goes down so this will result in loss of important investigation evidences and Forensic data .
• The solution for this is to do the data synchronization between the virtual machine and non cloud based storage basically the back up of data should also be maintained for any emergency.

4)Integrity

• The integrity of data is the issue because data can be modified by any customer in cloud computing so integrity is crucial as the evidence data collected should not be modified in cloud computing environment .
• The solution to this is using RSA and digital signatures and different hash strategies like SHA1,MD5 to protect the confidential information .

5) Cryptography

• The criminal uses the different encryption techniques to get the confidential data as encryption is provide nowadays to every customer to protect their data in cloud computing environment.
• The solution to it is that role based access policies should be developed for the encrypted data which is stored in the cloud computing environment two clouds can be used public cloud which store data in encrypted form and private cloud for maintaining the confidential investigation data.

6)Jurisdiction

• Cloud forensic is very big multidimensional issue which contains technical and legal domains so multiple jurisdiction may apply for setting up the clouds in different countries so investigation can be obstructed by the difference in laws and jurisdiction .
• The solution to this problem is to maintain the collaboration between different laws enforcement agencies and legal framework for conducting the crimes using cloud computing

7)Complexity of cloud computing

• There is not any proper understanding of cloud computing technology among the forensic team members as information exchange in such environment can make the forensic investigation more complex
• The solution to this issue that the experts of cloud computing has to full explain the technology by using time lining events which makes the team member of forensic team to better understand the principle of cloud technology.