Towards Development of a Cloud-Connected IoT Forensic Model

Abstract

Recent years have witnessed an increasing number of IoT-related cybersecurity incidents, which is mainly due to three reasons: immaturity of IoT security, extensive use of IoT technologies in various fields, and a dramatic surge in the number of IoT users (particularly, in case of cloud connected IoT (cloud-IoT) technologies). On the other hand, to execute forensic investigations that involve cloud-IoT environments, there is a need for knowledge and skill in different areas such as readiness, live and dead forensics. Though, accomplishment of this objective with the use of conventional approaches could be noticeably challenging. For that reason, it is must to develop a cloud-IoT forensic process model capable of guiding consumers before, during, and after the occurrence of an incident. The current paper is focused on developing a consumer-oriented process model. In addition, this study uses the Forensics Iterative Development Model (FIDM) to examine the effectiveness of the proposed model on a simulated cloud-IoT environment in reflecting two different cloud crime scenarios. The process of developing the model is elaborated in the paper. Considering the challenges extracted through a comprehensive literature review, this study defined the requirements that need to be satisfied by forensic process models aiming to make investigation within cloud-IoT environments. In this sense, the forensic process models introduced already in the literature were assessed on the basis of the requirements defined. Then, a set of inclusion criteria was formed for the evaluation of the conventional digital forensics process models so that we could mark out the best group of models that could have best contribution to developing the proposed model. The final output of the present paper was an innovative model called Cloud-IoT Forensic Process Model (CFPM) capable of taking into consideration the consumers’ perspectives. Finally, the CFPM performance was evaluated by implementing it on two case scenarios. The obtained results confirmed the high effectiveness of the proposed model in terms of performing the tasks defined.