|By Jon Shende||
|December 2, 2010 06:45 AM EST||
As mentioned in Part 1 of this article, one of my functions is to research current and up and coming solutions within the technology realm, particularly that of distributed computing and cloud computing.
It is a strong possibility that malicious users will eventually identify and exploit potential flaws within the cloud computing model. CSPs, in their pursuit to secure market share may have underestimated the possibilities of attack and misuse of their cloud resources by a malicious user or users.
The likelihood that the creation, storage, processing and distribution of illicit material will present major legal issues, is also a grave reality 
Digital Forensic Examiners also know that any effective forensic system has to have an effective means of monitoring and collecting a wide range of data as; there is no directive which states what may be pertinent to any one case a priori.
With regard to possibility of insider attacks, collecting data at the entry points of a network will not contribute to tracing insider attacks.
When our admin director signed me up to attend the webinar, The Case for Network Forensics - from Solera Networks a few weeks ago; to be honest I thought that it would be a variation of some tools already in use by another start-up.
The synopsis of this webinar had me recall a paper I read a while ago by a Gartner consultant  which stated, "Cloud services are especially difficult to investigate, because logging and data for multiple customers may be co-located and may also be spread across an ever-changing set of hosts and data centres," then, I figured it was only a matter of time before a start-up proved this statement wrong.
Enter Solera's discussion on network forensics. One takeaway was that the core nature of this product is that it is like a Security camera - and it records everything.
Ok I thought, digital forensics examiners typically have vast amounts of data to sift through in a traditional system anyway; how will this company's tools expedite the sorting and analysis to output what we need that is specific to an investigation within the cloud; which will be accepted in a court of law?
Also digital evidence by itself can be extremely fragile, in that it can be altered, damaged, or destroyed by improper handling or examination. As forensic examiners we know how critical it is to ensure that precautions are taken to document, collect, preserve and examine evidence. As you know any failure in this process can render a case inadmissible in court.
I took my questions to Peter Schlampp VP Marketing and Product Management and Alan Hall Director Marketing  from Solera, who provided insight as follows.
Within the cloud Solera's tools does not use a typical custom silicate, but rather will see packets as they are seeing it as if on a traditional system NIC. Integrated into a cloud service providers environments this system claims to ensure that the customer are the only one seeing aspects of their data and no one else.
Of course I wondered about the VM managers at the cloud service provider (CSP) who manages the VMs at this point, as they can see customers' data.
The response, I received was as follows: Data tracks on the customer view, will be that of who interacted with their system in the cloud and what types of connections came in to the system hosted in the cloud. In other words it records traffic between virtual host on a physical host.
The system also has an integration with Sourcefire's defense center, although I haven't conducted a PEN-TEST in over a year, I still keep updated on current processes and technologies within the IT Security - Pen-Testing world; knowing that SNORT is utilized, was an immediate plus for me.
In the event of an incident, an investigator can drill down to event level which shows the frame of traffic; an alert from a Sourcefire event will then go directly to a Solera networks device.
Data provided from this can provide answers to: How did the connection get initiated? How do you know what happened afterwards? And for a host that was compromised one can potentially follow paths.
Despite this I still express some concerns with regard to levels of assurance for data held within the cloud amongst others. In order to get objective feedback, I approached one of my mentors Mark Pollitt for his sage input. Although he expressed his concern regarding the Solera's pitch of "network forensics for amateurs," he did state that "anything that will make analysis easier and capable of being done (even just as triage) by less skilled operators is very useful."
Whilst not an endorsement, it put my mind at ease in the sense that: the company had a vision which was on track with regard to a direction for virtualization, the cloud and forensic examination.
As a technologist there is nothing like more data and case study results to satisfy my reserve, so I presented these concerns to Schlampp and Hall, who responded with food for thought as follows:
Advanced Solera Networks network forensics technology now gives the ability to make data more understandable to a common individual. Packet detail is now rendered as web pages, emails, IMs, MS Office docs, etc. That means we can utilize support staff that can interpret this "human visible" or "human readable" data and clearly understand that the data obviously contain information we don't want leaked from our organization. With the advances Solera Networks makes, users have more front line incident response personnel that can determine if the appropriate triage requires escalation to those limited personnel that possess the in-depth skills. Those skills, combined with a complete forensics record from Solera Networks appliances, can uncover exactly what happened and more importantly, help determine the proper course of action and do so quickly to close the gap in response time between incident and remediation.
In a perfect world, effective network forensics requires the ability to "capture it all, all of the time." When we don't know what we don't know, capturing it all is the only way to ensure we have the complete data to interrogate and create the accurate story of what happened. However, what we end up with in practical use is usually something short of "everything."
We have to factor in things like amount of storage at our disposal, how fast our networks are running, what data or systems we have determined as most valuable in our organization, data protection regulations, etc. Accounting for these and other factors, Solera Networks has real-time network forensics technology that lets you make choices on what to capture - all data on every segment; selective segments of data based on port, specific applications, protocols, IP addresses, etc.; or, even get as granular as analyzing every packet for specific information like a hex pattern and only retaining those packets.
Selective capture requires a trade-off between creating more manageable "haystacks of data" and "missing the needle" altogether because it is in a different haystack of data that we didn't have the foresight to capture. Because of Solera Networks approach network forensics technology has evolved to the point where we can stick with one haystack and have the tools to find the exact needle in near real-time.
With any new product only time can tell the benefits it will provide. With regard to digital forensics and the drive to adopt cloud computing systems, any tool that will improve results, reduce false positives and give an investigator data that is relevant, factual and which can be presented and accepted in a court of law will be valued. I believe that these tools combined with a system such as that of ForNet  could chart a part for forensics investigations within the cloud ecosystem.
Accordingly ForNet :"helps with the postmortem of any security incident including insider attacks. It can also store potential evidence for months, which is much longer than any existing solution. With an integration of its XML based query routing protocols, coalescing of synopses, and a user interface, an analyst can locate evidence relating to an incident efficiently and transparently."
1.Politt MM. Six blind men from Indostan. Digital forensics research workshop (DFRWS); 2004.
2.Digital Forensics:Defining a Research Agenda -Nance,Hay Bishop 2009;978-0-7695-3450-3/09 IEEE
4. Cloud Computing Storms: Biggs, Vidalis; IJICR Vol 1, Issue 1, March 2010
5. GARTNER. 2008. Tough questions: Gartner tallies up seven cloud-computing security risks.
6.Peter Schlampp VP Marketing and Product Management,Alan Hall Director Marketing - Solera Networks
7.ForNet: A Distributed Forensic Network, Kulesh Shanmugasundaram - Project ForNet NYU Polytechnic University.
As cloud adoption continues to transform business, today’s global enterprises are challenged with managing a growing amount of information living outside of the data center. The rapid adoption of IoT and increasingly mobile workforce are exacerbating the problem. Ensuring secure data sharing and efficient backup poses capacity and bandwidth considerations as well as policy and regulatory compliance issues.
Aug. 31, 2016 11:52 AM EDT
Aug. 31, 2016 11:45 AM EDT Reads: 757
Aug. 31, 2016 11:12 AM EDT Reads: 123
Aug. 31, 2016 11:00 AM EDT Reads: 450
Aug. 31, 2016 10:45 AM EDT Reads: 439
Aug. 31, 2016 10:11 AM EDT Reads: 175
Aug. 31, 2016 09:30 AM EDT Reads: 1,105
Aug. 31, 2016 09:00 AM EDT Reads: 522
Aug. 31, 2016 08:45 AM EDT Reads: 924
Aug. 31, 2016 07:45 AM EDT Reads: 962
Aug. 31, 2016 02:45 AM EDT Reads: 1,905
Aug. 31, 2016 02:15 AM EDT Reads: 2,299
Aug. 31, 2016 02:00 AM EDT Reads: 2,035
Aug. 31, 2016 01:45 AM EDT Reads: 3,116
Smart Cities are here to stay, but for their promise to be delivered, the data they produce must not be put in new siloes. In his session at @ThingsExpo, Mathias Herberts, Co-founder and CTO of Cityzen Data, will deep dive into best practices that will ensure a successful smart city journey.
Aug. 31, 2016 01:00 AM EDT Reads: 1,717
Aug. 30, 2016 08:15 PM EDT Reads: 2,506
SYS-CON Events announced today that 910Telecom will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Housed in the classic Denver Gas & Electric Building, 910 15th St., 910Telecom is a carrier-neutral telecom hotel located in the heart of Denver. Adjacent to CenturyLink, AT&T, and Denver Main, 910Telecom offers connectivity to all major carriers, Internet service providers, Internet backbones and ...
Aug. 30, 2016 08:00 PM EDT Reads: 2,051
Internet of @ThingsExpo, taking place November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 19th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devices - comp...
Aug. 30, 2016 03:30 PM EDT Reads: 3,811
SYS-CON Events announced today that Adobe has been named “Bronze Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York, New York. Adobe is changing the world though digital experiences. Adobe helps customers develop and deliver high-impact experiences that differentiate brands, build loyalty, and drive revenue across every screen, including smartphones, computers, tablets and TVs. Adobe content solutions are used daily by millions of co...
Aug. 30, 2016 02:00 PM EDT Reads: 3,857
Data is the fuel that drives the machine learning algorithmic engines and ultimately provides the business value. In his session at Cloud Expo, Ed Featherston, a director and senior enterprise architect at Collaborative Consulting, will discuss the key considerations around quality, volume, timeliness, and pedigree that must be dealt with in order to properly fuel that engine.
Aug. 30, 2016 01:15 PM EDT Reads: 2,090