Book Image

Cloud Forensics Demystified

By : Ganesh Ramakrishnan, Mansoor Haqanee
Book Image

Cloud Forensics Demystified

By: Ganesh Ramakrishnan, Mansoor Haqanee

Overview of this book

As organizations embrace cloud-centric environments, it becomes imperative for security professionals to master the skills of effective cloud investigation. Cloud Forensics Demystified addresses this pressing need, explaining how to use cloud-native tools and logs together with traditional digital forensic techniques for a thorough cloud investigation. The book begins by giving you an overview of cloud services, followed by a detailed exploration of the tools and techniques used to investigate popular cloud platforms such as Amazon Web Services (AWS), Azure, and Google Cloud Platform (GCP). Progressing through the chapters, you’ll learn how to investigate Microsoft 365, Google Workspace, and containerized environments such as Kubernetes. Throughout, the chapters emphasize the significance of the cloud, explaining which tools and logs need to be enabled for investigative purposes and demonstrating how to integrate them with traditional digital forensic tools and techniques to respond to cloud security incidents. By the end of this book, you’ll be well-equipped to handle security breaches in cloud-based environments and have a comprehensive understanding of the essential cloud-based logs vital to your investigations. This knowledge will enable you to swiftly acquire and scrutinize artifacts of interest in cloud security incidents.
Table of Contents (18 chapters)
Free Chapter
1
Part 1: Cloud Fundamentals
6
Part 2: Forensic Readiness: Tools, Techniques, and Preparation for Cloud Forensics
10
Part 3: Cloud Forensic Analysis – Responding to an Incident in the Cloud

DFIR Investigations – Logs in AWS

Through Chapters 1 to 3, you may have recognized the importance of the cloud in today’s technological landscape, and with any technological innovation comes threats against it. As organizations use more cloud products and host and store personal or sensitive information, it is prone to unauthorized disclosure, accidentally or by threat actors exploiting a vulnerability in the configuration of the systems. This chapter will focus on how to handle incidents that have occurred within Amazon Web Services (AWS). We will discuss various log sources that are available for investigators and how investigators can make use of these log sources.

Before we can begin our investigation, we will need to understand which logs are available by default versus which log sources must be explicitly turned on; something organizations should consider for ensuring breaches can be investigated thoroughly. We will focus on configuring these logs and look at...