EP158 Ghostbusters for the Cloud: Who You Gonna Call for Cloud Forensics

[chuvakin]

LISTEN TO THE EPISODE

Guest:

• Jason Solomon, Security Engineer, Google

Subscribe at Google Podcasts.

Subscribe at Spotify.

Subscribe at Apple Podcasts.

Subscribe at YouTube

Topics covered:

• Could you share a bit about when you get pulled into incidents and what are your goals when you are?
• How does that change in the cloud? How do you establish a chain of custody and prove it for law enforcement, if needed?
• What tooling do you rely on for cloud forensics and is that tooling available to "normal people"? 
• How do we at Google know when it’s time to call for help, and how should our customers know that it’s time? 
• Can I quote Ray Parker Jr and ask, who you gonna call?
• What’s your advice to a security leader on how to “prepare for the inevitable” in this context? 
• Cloud forensics - is it easier or harder than the 1990s classic forensics?

Resources:

• EP157 Decoding CDR & CIRA: What Happens When SecOps Meets Cloud
• EP98 How to Cloud IR or Why Attackers Become Cloud Native Faster?
• EP103 Security Incident Response and Public Cloud - Exploring with Mandiant
• Google SRE Workbook (Ch 9)
• GRR
• Cloud Logging
• LibCloudForensics, Turbinia, Timesketch tools

[johnfranolich]

Great podcast thanks Jason! I agree cloud is more ephemeral for cloud IR.

Questions:

Q1: In cloud what do you consider a security event vs. an incident? Is that different in cloud?

Q2: When it comes to monitoring ML environments, the community struggles because of various reason. There is the NVIDIA Morpheus project on github but its still a maturing space when it comes to cloud.  What design requirements do you ask from data scientists and engineers building out ML in the cloud that allows you to capture artifacts?

[chuvakin]

Not sure Jason is reading these, but I can try to answer.

Q1 Frankly, I don't see cloud breaking the "event vs incident" definition, in general. What I observed is a bit more uncertainty on what is considered an incident (e.g. on premise, a new vulnerability is very rarely an incident, while some cloud teams treat a major vuln as an all-hands-on-deck incident

Q2 Frankly, this is too long to answer here, perhaps we need a separate podcast episode on this. Got a guest in mind?