Integrating digital forensic practices in cloud incident handling: A conceptual Cloud Incident Handling Model

The Cloud Security Ecosystem: Technical, Legal, Business and Management Issues

Volumn , Issue , 2015, Pages 383-400

  Rahman, Nurul Hidayah Ab ^a,b   Choo, Kim Kwang Raymond ^a  

^a UNIVERSITY OF SOUTH AUSTRALIA   (Australia)

^b UNIVERSITI TUN HUSSEIN ONN MALAYSIA   (Malaysia)

Author keywords

Digital forensic; Incident handling; Incident response; Index terms cloud computing; Storage as a Service

Indexed keywords

EID: 85050883948     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1016/B978-0-12-801595-7.00017-3     Document Type: Chapter

References (42)

1. Albakri S.H., Shanmugam B., Samy G.N., Idris N.B., Ahmed A. Security risk assessment framework for cloud computing environments. Secur. Commun. Networks 2014, 7(11):2114-2124.
2. Aleem A., Sprott C.R. Let me in the cloud: analysis of the benefit and risk assessment of cloud platform. J. Financ. Crime 2013, 20(1):6-24.
3. Amazon Web Services, 2014. Amazon CloudWatch [Online]. Available: [Accessed: 28-Oct-2014]. http://aws.amazon.com/cloudwatch/.
4. Anuar N.B., Papadaki M., Furnell S., Clarke N. A response strategy model for intrusion response systems 2012, 573-578. Springer, Berlin Heidelberg.
5. Birk D., Wegener C. Technical issues of forensic investigations in cloud computing environments 2011, 1-10.
6. Böhme R. Security metrics and security investment models. Advances in Information and Computer Security 2010, 10-24. Springer, Berlin Heidelberg.
7. Buyya R., Vecchiola C., Selvi S.T. Cloud Computing Architecture. Mastering Cloud Computing:Technologies and Applications Programming 2013, 111-140. Morgan Kaufmann.
8. Cichonski P., Scarfone K. Computer Security Incident Handling Guide Recommendations of the National Institute of Standards and Technology (NIST) 2012, NIST, Gaithersburg.
9. Clarke R.V. Situational Crime Prevention: Successful Case Studies 1997, Harrow and Heston, New York. second ed.
10. Cloud Security Alliance, 2011. Security Guidance for Critical Areas of Focus in Cloud Computing, CSA [Online]. Available: [Accessed: 01-Aug-2014]. https://cloudsecurityalliance.org/guidance/csaguide.v3.0.pdf.
11. Cloud Security Alliance, 2013. The Notorious Nine Cloud Computing Top Threats in 2013, CSA [Online]. Available: [Accessed: 12-Jul-2013]. http://www.cloudsecurityalliance.org/topthreats/.
12. Dekker M., Liveri D., Lakka M. Cloud Security Incident Reporting Framework for Reporting About Major Cloud Security Incidents 2013, ENISA, Athens.
13. Freiling F.C., Schwittay B. A common process model for incident response and computer forensics. Proceedings of the 2007 IT Incident Management & IT Forensics (IMF 2007) 2007, vol. 7:19-40.
14. Grobauer B., Schreck T. Towards incident handling in the cloud 2010, 77-85.
15. Gupta R., Prasad K.H., Luan L., Rosu D., Ward C. Multi-dimensional knowledge integration for efficient incident management in a services cloud 2009, 57-64.
16. Gurkok C. Cyber forensics and incident response. Computer and Information Security Handbook 2013, 601-622. Elsevier. second ed.
17. Jansen W., Grance T. Guidelines on Security and Privacy in Public Cloud Computing 2011, National Institute of Standards and Technology, Gaithersburg.
18. Khorshed T., Ali A.B.M.S., Wasimi S.A. A survey on gaps, threat remediation challenges and some thoughts for proactive attack detection in cloud computing. Futur. Gener. Comput. Syst. 2012, 28(6):833-851.
19. Kohn M.D., Eloff M.M., Eloff J.H.P. Integrated digital forensic process model. Comput. Secur. 2013, 38(2013):103-115.
20. Kozlovszky M., Kovacs L., Torocsik M., Windisch G., Acs S., Prem D., Eigner G., Sas P., Schubert T., Póserné V. Cloud security monitoring and vulnerability management 2013, 265-269. no. 70.
21. Martini B., Choo K.-K.R. An integrated conceptual digital forensic framework for cloud computing. Digit. Investig. 2012, 9(2):71-80.
22. Martini B., Choo K.-K.R. Cloud storage forensics: ownCloud as a case study. Digit. Investig. 2013, 10(4):1-13.
23. Martini B., Choo K.-K.R. Remote programmatic vCloud forensics: a six-step collection process and a proof of concept 2014, 935-942.
24. Mell P., Grance T. The NIST Definition of Cloud Computing Recommendations 2011, National Institute of Standard and Technology, Gaithersburg.
25. Mitropoulos S., Patsos D., Douligeris C. On incident handling and response: a state-of-the-art approach. Comput. Secur. 2006, 25(5):351-370.
26. Modi C., Patel D., Borisaniya B., Patel H., Patel A., Rajarajan M. A survey of intrusion detection techniques in cloud. J. Netw. Comput. Appl. Jan. 2013, 36(1):42-57.
27. Monfared A.T., Jaatun M.G. Monitoring intrusions and security breaches in highly distributed cloud environments 2011, 772-777.
28. Monfared A., Jaatun M.G. Handling compromised components in an IaaS cloud installation. J. Cloud Comput. Adv. Syst. Appl. 2012, 1(1):1-21.
29. Pangalos G., Ilioudis C., Pagkalos I. The importance of corporate forensic readiness in the information security framework 2010, 12-16.
30. Patel A., Taghavi M., Bakhtiyari K., Celestino Júnior J. An intrusion detection and prevention system in cloud computing: a systematic review. J. Netw. Comput. Appl. Jan. 2013, 36(1):25-41.
31. Pearson S. Privacy, security and trust in cloud computing. Privacy and Security for Cloud Computing 2013, 3-42. Springer, London. S. Pearson, G. Yee (Eds.).
32. Pilli E.S., Joshi R.C., Niyogi R. A generic framework for network forensics. Int. J. Comput. Appl. 2010, 1(11):1-6.
33. Quick D., Choo K.-K.R. Digital droplets: microsoft SkyDrive forensic data remnants. Futur. Gener. Comput. Syst. 2013, 29(6):1378-1394.
34. Quick D., Martini B., Choo K.-K.R. Cloud Storage Forensics 2014, Syngress Publishing, Waltham, MA.
35. Rahman N.H.A., Choo K.-K.R. A survey of information security incident handling in the cloud. Comput. Secur. 2015, 49:45-69. 10.1016/j.cose.2014.11.006.
36. Ruan K., Carthy J., Kechadi T., Crosbie M. Cloud forensics. Advances in Digital Forensic VII 2011, 35-46. Springer, Berlin Heidelberg.
37. Saha A. A look at ownCloud. Linux J. 2012, 2012(218):64-75.
38. Sarkar S.R., Mahindru R., Hosn R.A., Vogl N., Ramasamy H.V. Automated incident management for a platform-as-a-service cloud 2011, 5-11.
39. Suarez-Tangil, G., Palomar, E., Ribagorda, A., Zhang, Y., 2014. Towards an Intelligent Security Event Information Management System [Online]. Available: [Accessed: 05-May-2014]. http://www.seg.inf.uc3m.es/papers/2013nova-AIS-SIEM.pd.
40. Trček D., Abie H., Skomedal A., Starc I. Advanced framework for digital forensic technologies and procedures. J. Forensic Sci. 2010, 55(6):1471-1480.
41. Tsalis N., Theoharidou M., Gritzalis D. Return on security investment for cloud platforms 2013, 132-137.
42. Zimmerman S., Glavach D. Cyber forensics in the cloud. IA Newsletter 2011, 14(1):4-7.