CLD-001 Cloud Services
What is a cloud service?¶
A cloud service provides computing, storage or software over a network, moving part of the potential evidence beyond the device and into systems controlled by a provider, organisation or both.
Evidence and questions to consider¶
- exact product or service;
- account or tenant;
- provider-held records;
- customer-organisation records;
- local copies, caches and authentication material;
- the event the evidence must explain.
Keep the sources separate¶
A provider record, customer-administrator report, application screen and device artefact may describe related activity without proving the same thing. Preserve exact identifiers, dates, times and time zones, and test shared access, delegation, automation, compromise and changing account control.
Key takeaway
Treat cloud evidence as several connected sources rather than one remote hard drive.