CLD-003 Cloud Services
Where is cloud data actually stored?¶
Cloud data exists on physical systems, but relevant content, metadata, logs, replicas and backups may be distributed across several systems, regions and legal entities.
Evidence and questions to consider¶
- service region and provider entity;
- live storage and replicated copies;
- metadata, audit logs and security records;
- backups and indexes;
- customer-held copies;
- other providers, resellers or managed services.
Keep the sources separate¶
A provider record, customer-administrator report, application screen and device artefact may describe related activity without proving the same thing. Preserve exact identifiers, dates, times and time zones, and test shared access, delegation, automation, compromise and changing account control.
Key takeaway
Focus on who controls each record and the lawful route to obtain it, not on finding one physical server.