Question

– A cloud customer has asked you to do a forensics analysis of data stored in on CSP’s server. The customer’s attorney explains that the CSP offers little support for data acquisition and analysis will help you with data collection for a fee. The attorney asks you to prepare a memo with detailed questions of what you need to know to perform the task .She plans to use this memo to negotiate for services you will provide in collecting and analyzing evidence .Write a one –to two page menu with questions to ask the CSP .

Answer 1

A one -two pages menu was written with questions directed to the CSP which is stated below in the explanation section

Step-by-step explanation:

Solution

If CSP has no team or limited staff, you will need to ask the following questions to understand how the CSP is set up:

• Is detailed knowledge of cloud topology, storage devices is available ?

• Are there any restrictions in taking digital evidence from a cloud storage?

• For e-discovery demands on multi tenant cloud systems, is the data of investigation local or remote?

• Does the investigator have the power to make use of cloud staff conduct an investigation?
• What is the relationship of CSP's with cloud users?

• What are the SLA's and what are the guidelines to define them ? SLAs should also specify support options, penalties for services not provided, system performance,fees, provided software/hardware.

• CSP must explain who has the right to access the data ? and limitations for conducting acquisitions for an investigation.

• For guidelines of operations, digital forensics should review CSP's policies, and standards..

• What are the CSP's business continuity and disaster recovery plans.

• Are there Any plans to revise current laws ?

• Are there Any cases involving data commingling with other customer's data?

• Ask What law controls data stored in the cloud is a challenge?

To access evidence in the cloud :

• What is the configuration of the CSP?

• Is the data storage location secretly kept or it is open ?

• Are there any court orders, subpoenas with prior notice, search warrants etc?

• What are the procedures for log keeping ? so that complications we not arise in the investigations chain of evidence.

• What is the configuration of the CSP?

• What is the right key of encryption to read the data if at all the CSP has provided encryption to the data.

• Is there any threat from hackers so that they will not use any malware an modify the file meta data?

• Does CSP have a personnel trained to respond to network incidents?

• Who are the data owners, identity protection, users and access controls for a better role management.