See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/312183828

Cloud incident response model

Conference Paper · October 2016

DOI: 10.1109/EWDTS.2016.7807665

CITATIONS READS

2 75

2 authors:

Alexander Adamov Anders Carlsson

Kharkiv National University of Radio Electronics Blekinge Institute of Technology
13 PUBLICATIONS   33 CITATIONS    26 PUBLICATIONS   148 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Nioguard Security Lab View project

EU Tempus ENGENSEC View project

All content following this page was uploaded by Alexander Adamov on 14 June 2021.

The user has requested enhancement of the downloaded file.

 Cloud Incident Response Model

Alexander Adamov
NioGuard Security Lab, Anders Carlsson
Kharkiv National University of Radio Blekinge Institute of Technology,
Electronics [email protected]
[email protected]

Abstract clouds must consider cloud-related features such as

distributed computing, high availability, and network
This paper addresses the problem of incident function virtualization to be efficient. Efficiency of the
response in clouds. A conventional incident response model can be estimated based on time criteria.
model is formulated to be used as a basement for the Early threat discovery and fast incident response are
cloud incident response model. Minimization of security challenges for an organization. The goal
incident handling time is considered as a key criterion function in such case is to minimize both time since
of the proposed cloud incident response model that can infection till threat discovery (TD) and incident
be done at the expense of embedding infrastructure handling time (IH) since threat discovery till
redundancy into the cloud infrastructure represented remediation and prevention making the whole incident
by Network and Security Controllers and introducing response process more efficient.
Security Domain for threat analysis and cloud
forensics. These architectural changes are discussed Z = min[T(TD)] + min[T(IH)] (1)
and applied within the cloud incident response model.
This expression states two type of security problems:
1. Introduction ● early threat discovery,
● fast incident response
The growing popularity of cloud technologies with To address fast incident response problem, the
an increased degree of virtualization rises new incident response model is used to organize all
challenges for the investigation of cyberattacks and mitigation, investigation, and remediation activities in
early incident response. The modern cloud architecture an efficient way.
dictates the requirements for the forensic investigation
and incident response model such as being scalable, 3. Conventional Incident Response Model
elastic, easy to integrate - integration with data plane,
and easy to manage - integration with control plane. It Let us formulate the main steps of the conventional
is just a matter of time when an organization will be incident response model based on NIST 800-61 [1],
compromised. Therefore, it is essential to develop an ISO 27035 [2], SANS’s Incident Handler's Handbook
incident response model taking in consideration IT [3], Common Incident Response model [4], and Agile
infrastructure of an organization at the design stage Incident Response model [5].
when a cloud is to be deployed. 1. Preparation
a. creation of an incident response team
2. State of the Problem (IRT)
b. development of the incident response
Current incident response guidelines NIST 800-61 strategy
[1], ISO 27035 [2], and SANS’s Incident Handler's 2. Discovery. A security scanner (IDS, firewalls,
Handbook [3] are comprehensive but they do not take or sandbox) or an operator triggers a security
into account complexity of cloud environments in their alert.
recommendations. The incident response model for 3. Containment. Limiting damage caused by the
incident.

978-1-5090-0693-9/16/$31.00 ©2016 IEEE

 4. Investigation ● P - prevention.
a. data collection including forensic It should be noted, that the incident handling time
image duplication does not include Preparation and Lessons learned
b. threat analysis using collected data to stages of the incident response procedure in this model.
create a report with information Thus, the formula (2) turns into:
about penetration, payload,
remediation, and prevention Z = min[T(IH)] = min[T(D) + T(I) + T(A) +
specifying indicators-of-compromise +T(R) + T(P)] = min[T(D)] + min[T(I)] + (3)
(IoCs). +min[T(A)] + min[T(R)] + min[T(P)]
c. information losses such as stolen
password, keys, certificates, and This formula must be taken into consideration when
other confidential information if any developing the time effective cloud incident response
5. Remediation model. The time reduction can be done at the expense
a. Remediation recommendations of introduction of new architectural elements such as
created by IRT include: management and threat analysis infrastructure
i. removal of malicious code embedded into the cloud.
and signs of its presence on
the infected hosts 5. Cloud Incident Response Model
ii. changing compromised
password, keys, certificates
b. Recovering hosts or/and network In cloud environment the following issues arise
devices from backups during incident handling:
c. Scan the recovered hosts, and ● Security alerts aggregation and notification
networks (Discovery)
d. Get back recovered hosts, and ● Security policy management (Containment,
networks to operation. Prevention)
6. Prevention. IRT also describes incident ● Network reconfiguration (Containment,
prevention steps, for example: Investigation)
a. revision of enabled protocols ● Data collection (Investigation)
b. install security updates to address ● Scanning hosts, VMs, networks (Discovery,
vulnerabilities Remediation)
c. update IDS, firewalls, and sandbox ● Running remediation and recovery scripts on
with new rules based on mined IoCs all nodes (Remediation)
7. Lessons learned ● Changing passwords, keys, certificates for
compromised services (Remediation)
● Applying security updates on all nodes
4. Minimizing Incident Handling Time (Prevention)
● Updating security tools with new rules
The incident response model must be optimized to (Prevention)
minimize the incident handling time - an interval To address them the following architectural
between the moment when an attack is discovered (D) elements should be added to the cloud environment,
and the moment when the attack is responded (R): which will help to reduced incident handling time:
● Logging, monitoring, alerts (LMA) module
Z = min[T(IH)] = min[t(R) - t(D)] (2) (Discovery)
● Software Defined Network (SDN) Controller
Minimizing incident handling time implies reducing for easy network reconfiguration
time at every step of the incident response procedure (Containment, Investigation)
since the security issue has been discovered. Let us ● Network Function Virtualization (NFV) for
denote every stage of the incident response procedure easy security policy management, scanning
as: networks (Discovery, Containment,
● D - discovery; Prevention, Remediation)
● I - investigation; ● Security Controller to manage security
● A - analysis; policies, updates, passwords, keys, and
● R - remediation; certificates. (Remediation, Prevention)
 Security Domain is a collection of forensic
● 6. Prevention. IRT also describes incident
and threat analysis tools to be used for prevention steps, for example:
collection and analysis of incident-related data a. revision of enabled protocols through
(Investigation). Security Domain may include Security Controller
a network sniffer, IDS/IPS, a sandbox b. install security updates to address
It is essential to design a cloud environment with the vulnerabilities through Security
aforementioned elements that will help further to run Controller
incident response smoothly with significant time and c. update IDS, firewalls, and sandbox
IRT efforts reduction. with new rules based on mined IoCs
So, the cloud incident response model is as follows: through Security Controller
1. Preparation 7. Lessons learned
a. creation of an incident response team
(IRT) 6. Conclusion
b. development of the incident response
strategy In this paper the problem of cloud incident response
c. enablement of SDN and NFV in the was stated. The conventional and cloud incident
cloud environment models were presented with an emphasis on
d. creation of Security Controller architectural redundancy needed to be embedded into
e. creation of Security Domain the cloud environment as a payment for incident
2. Discovery. A security scanner (IDS, firewalls, response time reduction. Namely, SDN enablement
or sandbox) or an operator triggers a security with NFV support, extending the cloud control plane
alert through the LMA module. with Security Controller, and introducing Security
3. Containment. Limiting damage caused by the Domain with threat analysis and forensic tools. The
incident by switching the compromised VM, main part of the cloud incident response model is
host, or network to Security Domain using embedding security controls and tools into the cloud
Security Controller. environment and providing flexibility in network and
4. Investigation security management.
a. data collection including forensic
image duplication using Security 7. References
Domain via the cloud control plane
b. threat analysis within of Security [1] Computer Security Incident Handling Guide, NIST 800-
Domain. 61, Sep 2016,
c. information losses http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S
5. Remediation P.800-61r2.pdf
a. Remediation recommendations
created by IRT include: [2] Information security incident management (ISO/IEC
i. removal of malicious code 27035-1:2016), Sep 2016
https://www.iso.org/obp/ui/#iso:std:iso-iec:27035:-1:ed-
and signs of its presence on
1:v1:en
the infected hosts through
Security Controller by [3] Incident Handler's Handbook, SANS Institute, Sep 2016,
running curing scripts https://www.sans.org/reading-
ii. changing compromised room/whitepapers/incident/incident-handlers-handbook-
password, keys, certificates 33901
using Security Controller
b. Recovering hosts or/and network [4] Felix C. Freiling, Bastian Schwittay, A Common Process
devices from backups using the cloud Model for Incident Response and Digital Forensics, IMF
2007, Stuttgart, September 2007, http://www.imf-
control plane
conference.org/imf2007/2%20Freiling%20common_model.p
c. Scanning the recovered hosts, and df
networks initiated by Security
Controller [5] G. Grispos, W. B. Glisson, T. Storer, Rethinking Security
d. Get back recovered hosts, and Incident Response: The Integration of Agile Principles, Sep
networks to operation using the cloud 2016, https://arxiv.org/ftp/arxiv/papers/1408/1408.2431.pdf
control plane

View publication stats