Feasibility analysis for incorporating/deploying SIEM for forensics evidence collection in cloud environment

— Cloud computing is the emerging field nowadays and it has truly revolutionized the domain of Information Technology. This domain is very large and not easy to handle especially when it comes to the forensic in a cloud environment that is considered a very cumbersome process. This paper presents a feasibility analysis of performing digital forensics via SIEM (Security Information and Event Management) system in cloud environment. The research work mainly focuses on passive attacks while some active attacks are also covered and the forensics analysis is done while considering the service provider end. The preliminary analysis presented in this paper will provide a comprehensive overview of the various artifacts that may be considered for performing an in-depth forensic analysis in cloud environment using Security Information and Event Management System. Keywords—Cloud Forensics; Security Information and Event Management; Openstack; Ubuntu Enterprise Cloud

• Type: Journal
• Year: 2015
• Where: ACISICIS
• Authors: Muhammad Irfan, Haider Abbas, Waseem Iqbal
• Keywords: ACISICIS 2015, Information Technology