Scribd Logo
Upload

Welcome to Scribd!

  • 135 views

    Cloud Forensics

    Uploaded by

    Weldon Kenei
    This document discusses cloud forensics and presents an attack scenario and evidence identification. It introduces cloud computing models like IaaS, PaaS, and SaaS and describes cloud forensics as a subset of network forensics tailored for the cloud. The scenario simulates SQL injection and DDoS attacks on an Apache webserver and fileserver in a virtual environment. Evidence was identified through logs from Snort, MySQL, and Wireshark network traffic captures showing the attacks. The conclusion states that evidence from IDS logs, application logs, API calls, and system calls from VMs can help investigators and a forensic-enabled cloud is needed to store and secure this evidence.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Cloud Forensics

    Uploaded by

    Weldon Kenei
    135 views6 pages
    This document discusses cloud forensics and presents an attack scenario and evidence identification. It introduces cloud computing models like IaaS, PaaS, and SaaS and describes cloud forensics as a subset of network forensics tailored for the cloud. The scenario simulates SQL injection and DDoS attacks on an Apache webserver and fileserver in a virtual environment. Evidence was identified through logs from Snort, MySQL, and Wireshark network traffic captures showing the attacks. The conclusion states that evidence from IDS logs, application logs, API calls, and system calls from VMs can help investigators and a forensic-enabled cloud is needed to store and secure this evidence.

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses cloud forensics and presents an attack scenario and evidence identification. It introduces cloud computing models like IaaS, PaaS, and SaaS and describes cloud forensics as a subset of network forensics tailored for the cloud. The scenario simulates SQL injection and DDoS attacks on an Apache webserver and fileserver in a virtual environment. Evidence was identified through logs from Snort, MySQL, and Wireshark network traffic captures showing the attacks. The conclusion states that evidence from IDS logs, application logs, API calls, and system calls from VMs can help investigators and a forensic-enabled cloud is needed to store and secure this evidence.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    135 views6 pages

    Cloud Forensics

    Uploaded by

    Weldon Kenei
    This document discusses cloud forensics and presents an attack scenario and evidence identification. It introduces cloud computing models like IaaS, PaaS, and SaaS and describes cloud forensics as a subset of network forensics tailored for the cloud. The scenario simulates SQL injection and DDoS attacks on an Apache webserver and fileserver in a virtual environment. Evidence was identified through logs from Snort, MySQL, and Wireshark network traffic captures showing the attacks. The conclusion states that evidence from IDS logs, application logs, API calls, and system calls from VMs can help investigators and a forensic-enabled cloud is needed to store and secure this evidence.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 6

    CLOUD FORENSICS

    REPORT AND SCENARIO PRESENTATION


    BY;
    GROUP 7
    INTRODUCTION
    • Cloud operates in three models, i.e. Iaas, Paas and Saas.
    • Cloud forensics is a subset of network that follows the main phase of
    network forensic with techniques tailored to cloud computing
    environment.
    • We leveraged the model of Iaas in our project by using machines in a
    virtual environment.
    • The machines include; an Apache webserver installed with MYSQL
    database and a fileserver
    ATTACK SCENARIO
    • We simulated an attack on both machine using common attacks such
    as;
     SQL injection attack; exploits un-sanitized user inputs in the webserver
     DDOS attack; used nping to flood the fileserver in order to prevent legitimate
    requests
    EVIDENCE IDENTIFICATION
    • In order to obtain evidence for forensic analysis;
     The webserver and the file server was configured to log access and query
    history,
     Installed SNORT in both webserver and fileserver, and
     Deployed Wireshark in host OS to monitor network traffic.
    • Snort was able to capture the SQL injection attack and generated alerts with
    appropriate rules
    • Wireshark also captured packets that formed DDOs attack.
    EVIDENCE IDENTIFICATION CONT’
    • Below are the SNORT alert and MySQL logs

    • A snippet of captured packets by Wireshark


    CONCLUSION
    • These scenario show evidence from three resources could help investigators.
    These evidence are from;
     IDS and application software logging,
     Cloud service API calls, and
     System calls from VMs.
    • In order to acquire these evidence, the forensic-enabled cloud should have three
    extensions which can;
     Store and secure APIs call logs, firewall logs and snapshots for running instances
     Retrieve IDS and software service logging, and
     Obtain system call when evidences from the above are missing.

    You might also like