CLD-009 Cloud Services
Who is the actual user of the cloud service?¶
The actual user may be a person, application or automated process that caused the recorded event. A cloud log normally identifies a digital account or session, not the physical person behind it.
Evidence and questions to consider¶
- account and session identifiers;
- device and application information;
- IP address and authentication method;
- timestamps and security events;
- device, CCTV, work and communications evidence;
- shared access, compromise and automation.
Keep the sources separate¶
A provider record, customer-administrator report, application screen and device artefact may describe related activity without proving the same thing. Preserve exact identifiers, dates, times and time zones, and test shared access, delegation, automation, compromise and changing account control.
Key takeaway
Corroborate account, session, device and process records before attributing activity to a person.