[Cloud and Web Service Security Lab]
Cloud Forensics
Mission Statement
Cloud Computing is arguably one of the most discussed information
technologies today. It presents many promising technological and
economical opportunities. However, many customers remain reluctant to
move their business IT infrastructure completely to the cloud. One of
their main concerns is Cloud Security and the threat of the unknown.
Cloud Service Providers (CSP) encourage this perception by not letting
their customers see what is behind their virtual curtain. A seldomly
discussed, but in this regard highly relevant open issue is the ability
to perform digital investigations. This continues to fuel insecurity on
the sides of both providers and customers.
Cloud Forensics constitutes a new and disruptive challenge for investigators. Due to the decentralized nature of data processing in the cloud, traditional approaches to evidence collection and recovery are no longer practical. Furthermore, the implementation of the technical architecture and circumstances within cloud computing environments bias the way an investigation may be processed. In detail, evidence data has to be interpreted by an investigator in a proper manner which is hardly be possible due to the lack of circumstantial information. For auditors, this situation does not change: Questions who accessed specific data and information cannot be answered by the customers, if no corresponding logs are available.
Mission Goals
- Addressing the technical issues of forensics in all three major cloud service models (IaaS, PaaS and SaaS)
- Considering cross-disciplinary aspects (e.g legal apects)
- Identification of potential sources of digital evidence in cloud environments
- Research specific API for forensic purposes
- Proposition of possible solutions helping to perform digital investigations
Research Agenda
SaaS Environments
Especially in the SaaS model, the customer does not obtain any control
of the underlying operating infrastructure such as network, servers,
operating systems or the application that is used. This means that no
deeper view into the system and its underlying infrastructure is
provided to the customer. Only limited user-specific application
configuration settings can be controlled by the customer. In a lot of
cases this urges the investigator to rely on high-level logs which are
eventually provided by the CSP. Given the case that the CSP does not run
any logging application, the customer has no opportunity to create any
useful evidence through the installation of any toolkit or logging tool.
These circumstances do not allow a valid forensic investigation and lead
to the assumption that customers of SaaS offers do not have any chance
to analyze potential incidences.
Current global acting public SaaS CSP offer Single Sign-On (SSO) access control to the set of their services. Unfortunately in case of an account compromise, most of the CSP do not offer any possibility for the customer to figure out which data and information has been accessed by the adversary. For the victim, this situation can have tremendous impact: If sensitive data has been compromised, it is unclear which data has been leaked and which has not been accessed by the adversary. Additionally, data could be modified or deleted by an external adversary or even by the CSP e.g. due to storage reasons. The customer has no ability to proof otherwise. Secure provenance mechanisms for distributed environments can improve this situation but have not been practically implemented by CSP.
PaaS Environments
One of the main advantages of the PaaS model is that the developed
software application is under the control of the customer and except for
some CSP, the source code of the application does not have to leave the
local development environment. Given these circumstances, the customer
obtains theoretically the power to dictate how the application interacts
with other dependencies such as databases, storage entities etc. CSP
normally claim this transfer is encrypted but this statement can hardly
be verified by the customer. Since the customer has the ability to
interact with the platform over a prepared API, system states and
specific application logs can be extracted. However potential
adversaries, which can compromise the application during runtime, should
not be able to alter these log files afterwards.
IaaS Environments
As expected, even virtual instances in the cloud get compromised by
adversaries. Hence, the ability to determine how defenses in the virtual
environment failed and to what extent the affected systems have been
compromised is crucial not only for recovering from an incident. Also
forensic investigations gain leverage from such information and
contribute to resilience against future attacks on the systems.
From the forensic point of view, IaaS instances do provide much more evidence data usable for potential forensics than PaaS and SaaS models do. This fact is caused through the ability of the customer to install and set up the image for forensic purposes before an incident occurs. Hence, as proposed for PaaS environments, log data and other forensic evidence information could be signed and encrypted before it is transferred to third-party hosts mitigating the chance that a maliciously motivated shutdown process destroys the volatile data.
Although, IaaS environments provide plenty of potential evidence, it has to be emphasized that the customer VM is in the end still under the control of the CSP. He controls the hypervisor which is e.g. responsible for enforcing hardware boundaries and routing hardware requests among different VM. Hence, besides the security responsibilities of the hypervisor, he exerts tremendous control over how customer's VM communicate with the hardware and theoretically can intervene executed processes on the hosted virtual instance through virtual introspection. This could also affect encryption or signing processes executed on the VM and therefore leading to the leakage of the secret key. Although this risk can be disregarded in most of the cases, the impact on the security of high security environments is tremendous.
Cross-Disciplinary Issues:
Besides the specific issues in SaaS, PaaS and SaaS scenarios, several
cross-disciplinary aspects of forensics in cloud infrastructures have to
be considered which count for each single service model alike. These
issues are mainly founded in the general concept of cloud computing and
do not result from specific service model characteristics.
The following list includes cross-disciplinary issues which are important for forensic investigations:
- Lack of Transparency
- Loss of Evidence Data
- Compliance Issues
- Secure Data Deletion
- SLA Verification
- Missing Best Practices