Conducting incident response and digital forensics
Incident response and forensics are challenging in cloud environments for several reasons:
- Our entire environment is stored at a physical location, managed by an external service provider.
- Our entire environment is split between our on-premises and a cloud provider (also known as a hybrid cloud environment).
- Our entire environment is split between multiple cloud providers (also known as a multi-cloud environment).
- Our cloud environment is in multiple regions or multiple cloud accounts (such as across an AWS account, Azure subscriptions, and GCP projects), and we might lack visibility to all resources deployed in our cloud environment or information about who owns or manages those accounts.
- According to the shared responsibility model, we may not have visibility for actions done by our cloud provider (such as a cloud engineer making changes to a managed database or performing a backup or restore from an SaaS...