WIXLIB

CLOUD SECURITY ALLIANCE Mapping the Forensic Standard ISO/IEC 27037 to Cloud Computing, June 2013vf. Management portal logsg. Packet capturesh. Billing recordsIn addition to forensic requirements that vary with the service model, forensic requirements might also dependon the specific capabilities of the customer and CSP. For example:1. A smaller company without an IT department has a SaaS application offered and hosted by the CSP. Thecompany is informed by an external party that their website is leaking customer data. The CSP providesa full “forensic service” including incident response (IR), reporting and re-building the system in a secureway. Without the help of the CSP, the customer does not have the access to data necessary to perform acomprehensive forensic investigation.2. An experienced customer with a large internal forensic department has detected “strange” behavior of aVM hosted by the CSP. In this case the CSP may have to provide some information, for example VMsnapshots and some firewall/router logs. The customer may need to pull and check utilization statistics,weblogs and real-time guest OS kernel events and file system checksums or hashes.2.1 Importance of the SlaThe need for SLOs embedded in the SLA is essential for specifying CSP responsibilities associated with forensicinvestigations. SLAs are a legally binding agreement between a cloud consumer and a cloud provider. SLOsdetermine the way that CSPs addressforensic investigations, including theprocess for identification andpreservation of potential evidenceRelevant Evidenceand access to data. For example, theimportance of SLOs in determining theaccessibility of potential evidence isillustrated in the following figureAccessible Sources of Evidencewhere the proportion of relevantevidence available as “accessiblesources of evidence” is determined bythe terms of the SLA.Within a cloud provider infrastructure,there may be many sources ofrelevant evidence. However, theFigure 1: Availability of Potential Digital Evidencecustomer may only have access to therestricted evidence set (the shaded area) provided by the CSP. In a cloud environment, it may be difficult toidentify all instances of relevant data (and therefore what should be memorialized as “accessible”). For example,virtual instances used by a particular customer may migrate transparently between various physical instanceswith little recordkeeping. What records do exist may be very transitory and only available for a short period of 2013 Cloud Security Alliance - All Rights Reserved.8

CLOUD SECURITY ALLIANCE Mapping the Forensic Standard ISO/IEC 27037 to Cloud Computing, June 2013vtime. The amount of accessible evidence may also be severely constrained by cost, technology (e.g., availablestorage space), multi-tenancy, privacy implications and other factors relevant to a particular CSP’sinfrastructure.For these reasons, it is critical that the customer understand the sources of potential digital evidence that will beavailable from the CSP, limitations on volumes of data, and retention periods. To avoid misunderstandings andpotential litigation, these understandings should be documented in SLOs within the SLA.In [6], the authors identify a list of key terms that can be included in the SLA in order to support forensicinvestigations. These key terms are organized under four categories: technical key terms, organizational keyterms, legal key terms and auditing key terms.2.2 General High-Level RequirementsThe latest release of Cloud Control Matrix (CCM) [12] has modified and added the following security principles(CO-04, DG-05, IS-24, SA-12) that cover forensic investigations.CO-04 Compliance – Contract/Authority Maintenance: Points of contact for applicable regulatory authorities,national and local law enforcement and other legal jurisdictional authorities shall be maintained and regularlyupdated as per the business need (i.e., change in impacted-scope and/or a change in any compliance obligation)to ensure direct compliance liaisons have been established and to be prepared for a forensic investigationrequiring rapid engagement with law enforcement.DG-05 Data Governance – Secure Disposal: Policies and procedures shall be established with supportingbusiness processes and technical measures implemented for the secure disposal and complete removal of datafrom all storage media, ensuring data is not recoverable by any computer forensic means.IS-24 Information Security – Incident Response Legal Preparation: In the event a follow-up action concerning aperson or organization after an information security incident requires legal action, proper forensic proceduresincluding chain of custody shall be required for preservation and presentation of evidence to support potentiallegal action subject to the relevant jurisdictions. Upon notification, impacted customers (tenants) and/or otherexternal business relationships of a security breach shall be given the opportunity to participate as is legallypermissible in the forensic investigation.SA-12 Security Architecture – Audit Logging/Intrusion Detection: Higher levels of assurance are required forprotection, retention, and lifecycle management of audit logs, adhering to applicable legal, statutory orregulatory compliance obligations and providing unique user access accountability to detect potentiallysuspicious network behaviors and/or file integrity anomalies through to forensic investigative capabilities in theevent of a security breach. 2013 Cloud Security Alliance - All Rights Reserved.9

CLOUD SECURITY ALLIANCE Mapping the Forensic Standard ISO/IEC 27037 to Cloud Computing, June 2013v3.0 ISO 27037ISO 27037 [14] is the first of a developing family of international standards that seek to create a commonbaseline for the practice of digital forensics. It is not intended to replace local laws or usurp local and nationalgovernments’ authority to regulate the practice of digital forensics. Rather, its intent is to facilitate the usabilityof evidence obtained in one jurisdiction by a legal process operating in another jurisdiction.Figure 1: Developing International Standards1As its title suggests, ISO 27037 only addresses the initial steps of the forensics process: identifying, obtaining andpreserving potential digital evidence2. Other steps in the forensics process are the subject of additionalstandards currently under development.12Diagram courtesy of Mr. Eric Hibbard of HDS and is used with permissionThe term “potential digital evidence” is used to recognize that evidence must be accepted by a court or other judicial. 2013 Cloud Security Alliance - All Rights Reserved.10

CLOUD SECURITY ALLIANCE Mapping the Forensic Standard ISO/IEC 27037 to Cloud Computing, June 2013vFigure 2: Evidence-Handling Processes According to ISO 270373.1 IdentificationThe forensics process begins with the identification of items that may be or may contain potential digitalevidence. Formally, identification is the “process involving the search for, recognition and documentation ofpotential digital evidence” [14].Although the identification of potential digital evidence sounds simple in principle, there are subtle complexities.For example, digital evidence has both a physical and virtual representation. Consider a hard drive containingpotential digital evidence. The physical location of the evidence is the hard drive, but the evidence itself is thedata contained within the drive. Furthermore, it also may not be at all obvious where potential digital evidenceis housed. A server may have very few directly attached disks and have a significant part of its storage within aSAN or NAS. As will be discussed later, these aspects of the cloud environment compound the difficulties inidentifying relevant evidence.3.2 Collection and AcquisitionAfter potential digital evidence is identified, it must either be collected or acquired: Collection – “Process of gathering items that contain potential digital evidence.” [14]Acquisition – “Process of creating a copy of data within a defined set.” [14]Collection is roughly equivalent to the standard law enforcement practice of seizing items containing potentialdigital evidence under authority of a legal order (i.e., search warrant) and removing them to a forensics lab orother facility for processing and analysis. Acquisition is more common in the private sector due to the need tominimize business impact of an ongoing investigation. Similar concerns with reducing the impact on otherapplications and customers will make acquisition the more likely process in the cloud environment as well.It should be noted that the copy created during acquisition can range from the forensic image of a hard drive toa copy of the contents of a server’s memory to the logical contents of an individual user’s email box depending 2013 Cloud Security Alliance - All Rights Reserved.11

CLOUD SECURITY ALLIANCE Mapping the Forensic Standard ISO/IEC 27037 to Cloud Computing, June 2013von the purpose and scope of the investigation. In all cases, the requirements for the copy are very similar: itmust be made using a well-understood, defensible, well-documented process. Furthermore, the process mustinclude integrity measures to ensure that the copy has not been modified since acquisition. The wide variety ofpotential digital evidence to be copied, and the requirements on the copying process, make acquisition a morecomplex and challenging process than collection.3.3 PreservationOnce potential digital evidence has been collected or acquired, it must be preserved. ISO 27037 definespreservation as the “process to maintain and safeguard the integrity and/or original condition of the potentialdigital evidence” [14]. The preservation of potential digital evidence is a complex and important process.Evidence preservation helps assure admissibility in a court of law. However, digital evidence is notoriouslyfragile, and is easily changed or destroyed. Given that the backlog in many forensic laboratories ranges from sixmonths to a year (and that delays in the legal system might create further delays), potential digital evidence mayspend a significant period of time in storage before it is analyzed or used in a legal proceeding. Storage requiresstrict access controls to protect the items from accidental or deliberate modification, as well as appropriateenvironment controls.3.4 Differences between Cloud Forensics and TraditionalForensicsAlthough cloud forensics and traditional forensic practices share a common foundation, cloud forensics hasunique barriers, challenges, and techniques. While many methods and techniques will transfer transparentlyinto the cloud environment, there are unique practices as well. The following section will focus on the IaaSdeployment model, but as noted previously, additional challenges will appear when moving to the PaaS or SaaSmodel (see 2.0 Forensic Requirements for CSPs).The first challenge in cloud forensics isthe identification of potential digitalevidence. With direct attachedstorage, it is easy to determine whichstorage device belongs to a givenserver. With the advent of storagenetworking and virtualization,mapping storage devices has becomemuch more complex and thiscomplexity increases in the cloudenvironment. For example, in the CSATrusted Cloud Reference Architecture[8] under “Infrastructure Services”(Error! Reference source not found.),torage is highly virtualized. A group ofFigure 4: Storage Virtualization in the Trusted Cloud Reference Architecture 2013 Cloud Security Alliance - All Rights Reserved.12

CLOUD SECURITY ALLIANCE Mapping the Forensic Standard ISO/IEC 27037 to Cloud Computing, June 2013vphysical disk devices may be virtualized as a set of logical units presented to a cloud user (or a server supportinga cloud user) with RAID level, cache settings, etc., to match the specific cost, reliability and performance profilerequired. These logical units may even be transparently moved from place to place based on global performanceand availability issues (perhaps storage instance “A” needs to be taken down for preventive maintenance so itslogical units would be migrated to instance “B”). The identification process would have to be cognizant of themapping and frequent migration to assure that the correct logical units were acquired.Since past instances of storage objects (e.g., previous versions of digital documents, deleted files, the remains oftemporary objects in free space, etc.) are often included in the corpus of relevant potential evidence, it ispossible that the previous instance of the logical units on “A” would be within the scope of the investigation.4.0 Mapping ISO 27037 to the CloudAlthough ISO 27037 is a relatively new standard (issued in October 2012) and only addresses the initial stages ofa digital investigation (identifying, collecting/acquiring, and preserving potential digital evidence), it representsan international public and private sector consensus of how potential digital evidence should be handled in thecritical initial steps of an investigation. There are many complex challenges of digital forensics in a cloudenvironment and this section will map and reinterpret the ISO 27037 guidance for a cloud context.4.1 General Requirements4.1.1 Requirements for Identification, Collection, Acquisition andPreservation of Digital Evidence - ISO 27037ISO 27037CLOUD5.3.2 AuditableIt should be possible for an independent assessor orother authorized interested parties to evaluate theactivities performed by a DEFR3 and DES4. Thisrequires appropriate documentation regardingactions taken, why and how.While this high-level requirement itself remains thesame for cloud environments, execution becomesmore difficult as investigations will likely beconducted on dynamic, distributed, and complexsystems that can neither be frozen nor easily3Digital Evidence First Responder – “individual who is authorized, trained and qualified to act first at an incident scene inperforming digital evidence collection and acquisition with the responsibility for handling that evidence” [14]4Digital Evidence Specialist – “individual who can carry out the tasks of a DEFR and has specialized knowledge , skills andabilities to handle a wide range of technical issues” [14] 2013 Cloud Security Alliance - All Rights Reserved.13

CLOUD SECURITY ALLIANCE Mapping the Forensic Standard ISO/IEC 27037 to Cloud Computing, June 2013videntified. Thus, the necessity for appropriatequalifications and documentation becomes evenmore important.5.3.3 RepeatableRepeatability is established when the same testresults are produced under the following conditions: Using the same measurement procedure andmethod Using the same instruments and under the sameconditions Can be repeated at any time after the originaltest5.3.4 ReproducibleReproducibility is established when the same testresults are produced under the following conditions: Using the same measurement method Using different instruments and under differentconditions Can be reproduced at any time after the originaltestWhile standard procedures and methods seem to beachievable even in a SaaS environment, conductingtests “under the same conditions” and “at any timeafter the original test” becomes more challenging(but not always impossible) within a dynamic,distributed, and complex cloud environment.For acquisition in current forensic practice regardingimaging memory, an active log file, or other dynamicprocess, the concept of “snapshot forensics” is used.The analogy is that no two successive snapshots of arunning child will capture exactly the same image(since the child is moving) but the snapshotaccurately captures the appearance of the child andher background at a moment in time. Assurance ofreliability for the snapshot then becomes assuranceof its provenance and that it has not been modifiedsince acquisition. Documentation can assure theidentity, place and time of the snapshot whiletraditional techniques such as cryptographic hashesand chain-of-custody processes can provide integrityassurances.The snapshot process is repeatable as it can bedemonstrated that the camera will

virtualized cloud computing environments. In some cases, cloud environments will exacerbate security challenges for cloud consumers due to the distributed, virtualized nature of the cloud [2, 3, 15]. Furthermore, the practice of digital forensics is also challenged by the migration to more complex