Experts reviews of a cloud forensic readiness framework for organizations

Abstract

Cloud computing has drastically altered the ways in which it is possible to deliver information technologies (ITs) to consumers as a service. In addition, the concept has given rise to multiple benefits for consumers and organizations. However, such a fast surge in the adoption of cloud computing has led to the emergence of the cloud as a new cybercrime environment, thus giving rise to fresh legal, technical and organizational challenges. In addition to the vast number of attacks that have had an impact on cloud computing and the fact that cloud-based data processing is carried out in a decentralized manner, many other concerns have been noted. Among these concerns are how to conduct a thorough digital investigation in cloud environments and how to be prepared to gather data ahead of time before the occurrence of an incident; indeed, this kind of preparation would reduce the amount of money, time and effort that is expended. As a number of cloud forensics challenges have not received enough attention, this study is motivated by a particular gap in research on the technical, legal and organizational factors that facilitate forensic readiness in organizations that utilize an Infrastructure as a Service (IaaS) model. This paper presents a framework with which to investigate the factors that facilitate the forensic readiness of organizations. This framework was identified by critically reviewing previous studies in the literature and by performing an in-depth examination of the relevant industrial standards. The factors were comprehensively studied and extracted from the literature; then, the factors were analysed, duplicates were removed, and the factors were categorized and synthesized to produce the framework. To obtain reliable results, the research method involved two steps: a literature review, followed by expert reviews. These techniques help us paint a comprehensive picture of the research topic and validate and confirm the results.

Cloud and Edge Computing-Based Computer Forensics: Challenges and Open Problems

“…CSP and client/investigator trust relationships are required at the highest level so that CSPs can provide specific information on request [51]. The authors of [52][53][54][55][56] have discussed using multiple layers of trust to allow customers and investigators to gather evidence, including VM images, network logs, processes and information. Both of these solutions seek to address the lack of transparency between CSPs and clients, which is why they build a relationship of trust.…”

“…Both of these solutions seek to address the lack of transparency between CSPs and clients, which is why they build a relationship of trust. However, as the authors of [51] point out, the level of dependence on the control aircraft is essential for the reliability model [53,54]. These solutions are also targeted at IaaS and PaaS models and cannot be successfully implemented in the SaaS model.…”

“…Cloud Forensic Readiness Framework [54] • Time, money and efforts have been reduced by thorough digital investigation and collection of data before the crime incidence.…”

“…Distributed Denial of Services (DDoS) and Malware Attacks [43]; 15. Dependencies due to service providers [43]; 16. In the public Cloud deployment model, consumers do not have physical access to the infrastructure, and their data privacy is much lower than those in the private cloud [54]; 17. Client computers in Cloud environments can provide minimal evidence due to the storage of real data on the CSP side [54];…”

Towards the Development of an Integrated Incident Response Model for Database Forensic Investigation Field

“…While it is important to acknowledge that these models have offered very significant insights towards the development of IIRM, we put across one core advantage that IIRM holds. IIRM is able to cover pre-incident preparation that has explicitly been presented at a readiness phase [3], this phase not only is able to shorten the process of conducting an investigation in databases but also it saves time due to the availability of forensic evidence when needed [52][53]. As far as IIRM is concerned this would be executed by implementing security policies as was mentioned and highlighted previously in Figure 3.…”